Wearable Technology: The Coming Revolution in Healthcare

By Vala Afshar Chief Marketing Officer, Extreme Networks

The year 2014 may well go down as theyear of wearable technology. The impact of wearables is already being felt in education, communication, navigating, and entertainment; but perhaps the greatest potential lies in healthcare. Wearable technology has started to revolutionize healthcare by assisting doctors in the operating room and providing real timeaccess to electronic health records.

The full potential of wearable technology in healthcare, though, goes well beyond directly assisting doctors. Patients can now continuously monitor their own health. At the 2014 Consumer Electronics Show in Las Vegas, Sony, LG and Garmin introduced devices that track everything from heart rate and blood pressure to a patient's O2 saturation. By 2018, the overall number of wearable devices shipped to consumers is expected to reach 130 million. With such acceptance on the part of the public, wearables are perhaps the perfect application for healthcare.

To learn more about wearables in healthcare, I spoke with David Peterson, Chief Marketing Officer for Emdeon, a company well-experienced in linking healthcare payers, providers and vendors. David believes that the adoption of wearable healthcare-related devices could indeed be a significant step in patient engagement and improving population health -- two critical success factors driving today's increasingly complex healthcare environment. Specifically, wearable health technology brings three distinctly beneficial trends to the table -- connected information, community, and gamification. By harnessing this trifecta, healthcare leaders have new ways to build engagement and create accurate, far-reaching views of both personal and population health.

David Peterson - CMO Emdeon Inc.

Connected Information

Healthcare information has traditionally been extremely siloed. Finding ways to integrate, aggregate, and analyze disparate data can be difficult and costly, but is needed to move healthcare toward cost-effective, evidence-based treatments. Furthermore, privacy and security considerations, like HIPAA regulations, have presented technical challenges related to the exchange of healthcare data.

To successfully employ wearable health technologies, the industry must find a way to develop networks that allow information access and provide support on the back end. This is already being done on a small scale: think about users of Fitbit® and similar health and wellness tracking gear who view their personal data and compare it against data from other users.

Having a network or backbone that a much broader population base can seamlessly connect to will fuel more meaningful data comparisons and analysis and distill useful information. This may spur wearable health technology vendors to partner with organizations that have extensive national networks and access to a large volume of health claims and other patient data. Companies like Emdeon, which processes more than seven billion U.S. healthcare transactions annually, and programs like theDepartment of Veterans Affairs Blue Button initiative or the Health Data Consortiumcan play a key role. Such a network could then aggregate data from wearables with other health information -- data from across a certain geography or specific diagnosis, for example -- to create a more complete picture of group health.

Community
Creating healthcare communities from which to collect data is a way to crowd source valuable healthcare information. By bringing together people with a common interest such as weight loss, wearables serve as a mechanism to build engagement and at the same time compile information. It is a logical approach: The more you know about a population's health, the more steps you can take to keep them healthy.

For instance, patient data entered into electronic health records at practices and hospitals could reveal allergies, health histories, and medication use. Combined with information collected through wearables, providers will have more complete and essentially real-time data to treat and manage the health of individual patients, as well as patient populations.

Gathering data this way is somewhat like microphilanthropy, where individual donors give small amounts to charity over a period of time. The real power comes from the cumulative sum of the donations from many individuals. In healthcare, the exponentially larger pool of data about a health condition or population could prove tremendously powerful.

Gamification
With information networked and communities built, participation in wearable groups can be driven by gamifying healthcare and fitness apps. Most of us are competitors at heart, and we love a good game. Imagine the interest in competing not against three or four friends who are trying to lose weight or lower cholesterol levels, but rather against a larger group of individuals who are members of your health plan or who share a similar health condition.

Health plans might offer incentives to members willing to sign up for designated wearable health programs and join in the "game." The incentives build participation by making the competition more engaging for participants. Growing the volume of data collected has the potential to broadly improve population health.

The Future

Surprisingly enough, wearable technology dates back to the 1200s, when the first eyeglasses were made out of crystal. Fast forward a few hundred years, when Chinese artisans of the Qing Dynasty created an abacus worn as a finger ring. Today, wearable health technology comes in the form of smart clothes, including sneakers, glasses, watches, rings, and more. Regardless of what they look like or how they are worn, wearables will play an pivitol role in the future of healthcare.

As the accuracy and scope of data improve, wearables hold the potential to reduce healthcare costs by identifying trends and commonalities among certain populations -- thereby enabling better preventive care. In addition to engaging patients and aiding personal wellness, they can move healthcare beyond individual monitoring and treatment toward more effective population health management.

By engaging and empowering patients to take an active role in data collection, wearables can change the way data and analytics are used to improve health. It is fascinating to think about, just as the abacus ring must have captivated the ancient Chinese. Consider how this can become the healthcare equivalent of how Google Maps displays traffic; showing healthcare patterns based on real time reporting of anonymous data from healthcare wearable devices.

While technology may never completely replace the all-inclusive health record, a detailed diagnosis or a one-on-one dialogue between patient and provider; the data collected from these devices can provide a broader scope of information. Healthcare organizations can tap the power of that data to engage patients and develop more effective and more personalized approaches to care, thereby lowering the overall cost of care.

This post was co-authored by David Peterson, Chief Marketing Officer for Emdeon.

How Do Health Information Websites Score on a 100-Point Customer Satisfaction Scale?

Private-sector health information websites scored a 79 on a 100-point customer satisfaction scale, while health insurance websites scored a 51, according to a study by ForeSee, a customer experience analytics firm.

Public-sector health information websites scored a 78 on the scale, according to the study. The study defined public-sector health information websites as those maintained by the federal government and not-for-profit organizations. Meanwhile, hospital and health system websites scored a 78.

Two sub-categories of private-sector health information websites -- sites that included information about pharmaceuticals and health products -- both scored a 76.

The study also found that health information website visitors who give a satisfaction rating of 80 or higher say they are 127% more likely to use the site as their main resource for interacting with a health care organization.

Results are based on an analysis of 100,000 surveys conducted from August to September 2011.

Source: ForeSee, "The 2011 ForeSee Healthcare Benchmark"

Read more: http://www.ihealthbeat.org/data-points/2011/how-do-health-information-websites-score-on-a-100-point-customer-satisfaction-scale.aspx#ixzz1e7MvNDBv

7 Habits for Effectively Leading Healthcare Interoperability Initiatives

Habit 1: Be Proactive

The proactive habit can be applied in multiple ways to foster healthcare interoperability.

Flexibility in Data Transformation

First, there are multiple applications or healthcare providers that require patient information to be communicated in a specific data format. Each vendor or provider, of course, believes that their format should be the one followed. Consequently, one could be reactive and just wait for the other vendor or provider to change the way they accept or send patient data; however, doing this results in a stalemate. The better approach would be to act in a flexible manner and transform the data in the middle to the different specifications. An added benefit to this approach is the ability to implement a best-of-breed application approach, since the differing data formats can be transformed easily in the middle.

Leveraging Engine Technology

Second, working with other application vendors or medical device manufacturers can be a restraining experience. Waiting for point-to-point interfaces to be developed, delivered, and tied to their queues can be frustrating. Being proactive can be liberating. By leveraging interface engine technology, independence from various vendors can be gained while delivering healthcare interfaces to your customers in a more timely fashion.

Regional and Community Initiatives

Third, there are several regional or community based initiatives which are driving RHIOs or other healthcare interoperability efforts. Similarly, the Federal government has dedicated resources and issued directives around a more integrated healthcare system. Why do anything? Let the agencies and communities drive it. Although that is a possible approach to take, it is clearly a reactive one and may result in more pain later.

Organizations that take the initiative and are proactive in connecting with their departments or referring physician communities are realizing benefits today. From saving dollars with more efficient processes to increasing revenues by offering a better way to interact, the proactive approach can have a positive impact today while also offering a direction for struggling community initiatives.

IT Service

Finally, another proactive approach to healthcare interfacing is the way IT service levels are delivered. The reactive approach is to claim ignorance, because the monitoring capabilities are not available. The best proactive approach is to be alerted when an interfacing parameter has not met a defined threshold, and you receive a page or email with the change in status. Essentially, with this approach, you are the first to know and the first to respond. By being proactive in healthcare integration, the end result is:

• Adaptability – being flexible to adapt to the various data requirements
• Independence – removing total reliance on others to achieve your objectives
• Satisfaction – delivering responsive customer service

With a proactive mindset and approach, the move from being dependent to being interdependent begins.

Habit 2: Begin with an End in Mind

What is the end game? Is it streamlined patient data flow? Is it robust, connected healthcare workflows? Is it physician outreach, connecting to practices in an electronic manner? Is it just doing it in a simpler, less costly, and easier to manage way?

Envisioning what healthcare interoperability means for your organization is important in developing and implementing the right strategy and healthcare IT tactics. You need a target. Like the old adage says, “If you aim at nothing, you'll hit it every time.” Direct your aim at the end in mind. If just connecting two applications to each other is the end game, then a point-to-point interface may be the best approach.

If monitoring a point-to-point interface while extending the leverage to other applications, then a mixed approach—point-to-point and interface engine—may be the best approach. If implementing a best of breed application strategy while connecting to referring physicians, laboratories, and imaging centers is the end game, then an integration platform may be the best approach.

Deciding what you want to achieve for your hospital, radiology practice, laboratory or clinic is important in deciding what integration approach should be taken. Without visualizing the end game, it usually translates into just muddling through. Muddling through costs more, frustrates more, and results in less. Recently, an executive director at a radiology practice was determining ways to offer better service to their referring physician community. The end game in her mind was delivering better service, and she knew that certain technology investments were necessary to realize that end game plan.

In her words, read the insights about how habits 1 and 2 came into play to move to a more interdependent approach.

“We knew we needed to integrate more technology across our practice. We needed to increase the efficiency of processes associated with billing and diagnostic reporting. In addition, we are receiving an increasing number of requests from referring physicians for HL7 interfaces. We wanted the control to respond quickly to these requests and the flexibility to accommodate all of the different HIS, PMS and EMR systems they might be using.”

With better service as the vision, the elements that needed to be in place in order to make it a reality came into full view.

Habit 3: Put First Things First

The patient is first. Delivering high quality patient care in a timely and accurate manner is fundamental. What helps facilitate putting patients first? There are many answers to this question. Having the right physicians, nurses, and other personnel is an essential part of the formula. Having the right facilities and equipment is a vital part of the formula. Having the right systems, applications, and ways to connect them is an integral part of the formula.

While the quality of care is largely determined by human hands, an expert mind and caring spirit, the delivery of the care is equally important. Healthcare IT plays a critical role by managing the systems and integrating the data flow. With IT support, the patient care experience becomes seamless through the various workflows.

In healthcare interoperability initiatives, key IT decisions need to be made in order to determine what needs to be put first. Decisions include:

Defining the integration benchmarks and desired results

• Development cycle time
• Deployment cycle time
• Resource requirements
• Manageability

Defining the desired turn around times

• Delivering patient reports to referring physicians
• Response time to correct a connection issue
• Re-sending an HL7 message from log files

Defining the operational cost structure to the integration platform environment

• Resource type required (e.g., Java engineer, IT analyst, etc.)
• Cycle time requirements
• Manageability requirements

These decisions along with others will drive your healthcare integration approach and aid in identifying which principles should come first.

For example, a large hospital used older technology to facilitate their integration efforts. The platform worked, but several issues arose. First, the existing integration platform required skilled Java developers, and these resources can be expensive. Second, the development and deployment cycle times for new interfaces were long and costly. Third, insight into how the interfaces were performing was challenging. On the surface, everything was working fine. Underneath the surface, challenges and issues were brewing, threatening to undermine the vision of delivering first-class patient experience.

Instead of waiting, the IT department took the initiative, explored new integration platforms, and initiated a migration. The result was better manageability of the integration environment and an exponential improvement in cycle times. In fact, over 30 interfaces were developed and deployed within the first six months after one training class.

Although the change was in the IT infrastructure, patient care was positively impacted. Key comments from the IT department included: “…our patients do not experience delays in the services they receive…” “We are able to deliver high quality patient care… orchestrating the clinical data flow between our healthcare applications.” With patient care coming first, the IT organization aligned itself to deliver.

Getting stuck in the IT issues (e.g., old technology platforms, “we’ve always done it this way,” etc.) keeps organizations in a dependent model. Moving beyond the typical IT issues and focusing on the important mission moves the overall organization beyond dependency.

Habit 4: Think Win/Win

With the first three habits firmly in place, independence is gained, and the transition from dependency to interdependency can begin. What does interdependency mean in healthcare? It means working with external healthcare providers in a seamless, integrated way. It also means facilitating data flow efficiently between different internal applications.

The seamless, productive interaction with external providers in tandem with high quality, effective data flow between internal applications is an interdependent healthcare environment. The end result of an interdependent healthcare community is enhanced patient care, including less frustration because the care experience is connected.

To gain these attributes of an interdependent healthcare environment, the first step is the win/win habit. How can healthcare IT organizations create win/win mindsets with others? Defining mutually beneficial terms is a start, and it needs to happen at three levels – with departments, external providers, and vendors. Often times, the IT mindset is:

• Departments – “I’ll deal with it later.”
• External providers – “How are we going to handle all these additional connection points?”
• Vendors – “They want how much for one interface? What do you mean it will be six months to get that interface?”

All of these may be valid points, but coming in with that thought process will only push the vision back to one of dependency, not move it forward. The right mindset will help to structure the right approach to continue to move the healthcare interoperability initiatives in the right direction.

For example, a laboratory was doing business as usual. Getting interfaces from their LIS vendor was a long and costly process. At the same time, the CIO saw that many of their referring clinics were beginning to install EMR applications. With a win/win mindset, the CIO determined what their referring clinics required, and they explored new technologies to gain independence from their LIS vendor. By deploying an interface engine approach, healthcare interoperability happened to over 200 different physician offices. Without the mindset to determine a better approach, this would have been a story of lost business and lost opportunity. Instead, it is one of making a difference in their network of care.

Habit 5: Seek First to Understand, Then to Be Understood

Many times, we jump to what we need, rather than listening to what our partners are requesting. A simple question to ask to gain greater understanding should be “What are you going to do with the information that I give you?” By asking this question, it provides greater insight to how what you will deliver will be used. Many times, this will highlight additional information that will be required to deliver either to or above expectations.

Having a conversation without first understanding the other organization’s objectives, drivers, or concerns will be hollow. From one viewpoint, it will seem like one organization is dictating to the other. From another vantage point, it will be one of “they just don’t get it.” It is much easier to be understood when you first understand the other person or organization’s perspective.
As outlined above, there are three primary players in the healthcare interoperability picture, and each have a differing set of requirements. Understanding each, rather than assuming, is imperative.

Departments. In hospitals, there are many different ancillary applications that support critical functions for different departments. For example, the emergency room department has unique characteristics that require unique applications to support their activities. This extends to other departments from radiology to laboratory to dietary.

The departments are working diligently to perform their responsibilities in the most cost-effective, efficient manner possible. Interoperability is essential for departments in order to gain access to patient information quickly.

What are the key drivers for each department? Understanding the answer to this question will lead to a better understanding. Two key areas to explore include:

• Integration points – What patient information is required? Are all the points of integration internal or are there external points as well?
• Manageability – What level of involvement does the department want in terms of integration? Do they want the flexibility to build their own interfaces? Do they want the insight to know the status of the interface points? Do they want to troubleshoot or resend patient messages if problems occur?

Listening and understanding to what is needed will help craft the right approach.

External providers. External providers depend on your perspective. In many cases, it is the physicians who refer patients; the laboratories who conduct the standard or special tests; or the imaging centers who take, read, and analyze detailed images. The key areas to explore include:

Capabilities – What level of capability do the external providers have to electronically send or receive patient information? What time schedule are they on to be electronically connected with selected hospitals?
Systems – What systems will accept the information (e.g., EMR, RIS, HIS, LIS, etc.), and what data format is acceptable (e.g., HL7, CCR, etc.)?

Vendors. With vendors, the conversations can sometimes be demanding. Granted, vendors create some of the problems in enabling a cost-effective approach to integrating various applications together. It is like a struggle between countries. Each country has their own interests and wants to protect their boundaries and their sovereignty.

Understanding the perspective of the vendor may be critical to determining the best approach. This will be the toughest challenge for many providers to do, but a vital one. By understanding the vendor’s approach to integration or interfacing, you will be able to better define your organization’s healthcare interoperability approach.

Habit 6: Synergize

Although the word “synergize” is an overused term in the business world, it is critical to work with people from other departments or organizations with which you are trying to connect. If interdependence is to be achieved, then the sum of all the parts needs to work consistently and effectively with the whole.

What does synergize actually mean? Another term for synergy is alliance. In the healthcare environment, instead of treating each party as a department or vendor, it may be better to treat them as alliances. For alliances to work, everyone involved needs to work together. That is the point of synergy, and it is necessary to make connected healthcare initiatives work.

A few quick points:

• Do you involve other departments in the process of determining the best way to improve the flow of patient data?
• Do you work with your vendors to solve problems?
• Do you work with your referring physician community or reference laboratories or imaging centers to understand their requirements or to solve interoperability issues?
• Are you viewed as an alliance partner in your connected healthcare community or as an individual part?
• How much can your organization take on? Is there another approach to gain leverage?

The key point – recognize the individual difference but work to build an alliance with all the individual organizations involved. It is not an easy task, but each of the habits provide for a direction to realize this important point.

Examples of building synergy occur within provider organizations as well as vendor organizations. One example of building synergy is offered from a vendor perspective. Many development organizations try to do it all – build the best features for their application, build the best infrastructure platform in which their application is based, build the best way to capture customer requests into new releases, etc. In reality, doing it all internally can stretch resources and can become uneconomical.

One such vendor was in that situation. It was trying to release new features while also attempting to offer a robust integration platform to meet every customer requirement and incorporate every new healthcare standard that came along. Fractures soon began to emerge as the weight of their “do-it-all” approach bore down on the development staff. Consequently, the R&D director began to open up the approach and look at alternatives.

One alternative was to create an alliance with another company that could offer the integration platform to meet any client requirement and any healthcare standard. Through a collaborative partnership, focus returned to offering new features to meet growing customer requirements while offering robust integration through a seamless partnership. Growth in features, growth in revenue, and growth in customer satisfaction were happening in tandem. Although different habits were utilized to get to this point, this story illustrates synergy at its best.

Habit 7: Sharpen the Saw

If there is only one thing that we can do in our life or in our organizations, it should be to look continuously for ways to improve. Whether it is in our client relationships, the way we solve our problems, or the way that we approach solutions, keeping our eyes open to new ways to do things is a must. This process of renewal will keep progress moving forward.

To achieve healthcare interoperability in our communities, continuous improvement is a must, because – if for no other reason – there are so many changes to which we need to adapt. There is a simple choice – adapt and improve or maintain the status quo and keep the paper flowing.

Improvements can be realized in many different areas including:

• Resources required to build, test, and implement a connected community
• Mindset in working with various constituencies – departments, providers, and vendors, etc.
• Processes or workflows – understanding the desired flow and mapping the right technology to support the vision
• Technology platforms to support healthcare interoperability

The improvements can be realized through many different resources. From workshops and trade shows to case studies, white papers, and blogs, there are many different avenues to continue to grow and adapt. There also is simple interaction. Talking with people from similar or different organizations to gain their perspectives can open the thought process. Setting aside the time to learn and improve is the first step.

Summary

The demands for healthcare interoperability are clearly increasing. How the demands are met will determine the success rate. Stephen Covey provided a great framework to work through most issues and realize most visions. Although it is a practical approach, it is challenging to adopt the habits and make the changes necessary to stop the inherent dependencies and move to a more interdependent environment.

Organizations are achieving varying degrees of success in pursuing an integrated healthcare community. It may be through brute force, new ways, or just luck. Leveraging and using the 7 Habits is one way to make a longer-term impact on the goals and will make the process of getting there more rewarding.

Healthcare interoperability and the 7 Habits seem like a match made for success.

UiTMedicalNet Network - One to any at 8Mbps rate

UiTMedicalNet Network Design & Implementation Requirement:

1. The wired network infrastructure is the “nervous system” of daily operations and must be secured to insure normal operations. This security must be considered in every phase of network design, implementation, and maintenance.

2. Using some general guidelines to secure the wired network, many threats to the network can be reduced if not eliminated. Part of this security includes protecting the medium on which this information travels including the wired network infrastructure.

3. Compliant with the Health Insurance Portability and Accountability Act (HIPAA) was enacted to protect health information by establishing transaction standards for the exchange of health information, security standards, and privacy standards for the use and disclosure of individually identifiable health information. Entities directly impacted by this act are health plans, health clearinghouses and healthcare providers.

4. Even there are other rules incorporated in HIPAA, the Security Rule has the most direct impact on the hospital’s wired network infrastructure. This rule addresses security measures such as user authentication, access controls, audit trails, controls of external communication links, and physical security. With increasingly more information being stored and transmitted electronically, the Security Rule works to identify and regulate these activities (Gue, n.d.).

5. Steps to Secure the Wired Network Infrastructure and Meet HIPAA Standards As with any security strategy, securing the wired network infrastructure must be done in layers. The use of layers provides the hospital multiple lines of defense as well as helping eliminate single points of security failure.

6. The way network security is designed and implemented is shifting due to increased needs and new security vulnerabilities inside of the organization. It was long thought that all that was needed was a hard external shell and a soft internal network. In today’s environment, this couldn’t be further from the truth. We must continue to harden the perimeter while increasing the security inside of the trusted network to help mitigate internal security threats (Alomary and Jamil, 2004). As stated by Rabinovitch (2003), “network security can be protected through a combination of high-availability network architecture and an integrated set of security access control and monitoring mechanisms”

7. In the following sections, a look will be taken at some general steps that can be taken to help achieve this layered security integration approach to the wired network security. Because each section of this paper could be the primary topic of many papers, a broad approach will be taken giving general practices and concepts. So although a detailed demonstration of the techniques needed to accomplish the security goals for a hospital will not be covered, design concepts and best practices will help to ensure that the correct security path is taken.

8. When securing a hospital network, a secure perimeter is the first step in overall network security. As stated by Sood (n.d.), “when one connects the enterprise network to the Internet, one is connecting its network to the thousands of networks that are unknown thus giving millions of people the opportunity to access your assets”. Because the perimeter is vulnerable to attacks from the Internet and so much is at stake, great care must be taken to ensure that it is secure.

9. When considering perimeter security, a look must be taken at the devices that will be used. In many organizations, various types of firewalls and remote access devices are deployed for perimeter protection. Although this is a solid practice, we must ensure that these devices are configured correctly to provide the security for which they were designed. As stated by Kincaid (2004), “an improperly located, configured, or monitored firewall can give a false sense of security for an organization” (pg.1). It is imperative that the utmost attention to detail be taken with the design and implementation of perimeter security devices.

10. There are many types of firewall that can be used in today’s networks. Initially a decision must be made on the type of firewall to be used at the perimeter. Firewalls can be categorized into the following types: packet filtering, proxy, and stateful firewalls. In many cases, the organizational and network structure will dictate which type of firewall is deployed. In a hospital environment, a stateful firewall is typically the firewall of choice.

11. This is because the stateful firewall keeps track of actual communications state tables which can be useful for IDS and various types of communications required in a hospital environment. Moreover, its ability to track connectionless protocols such as User Datagram Protocol (UDP) makes it a prime candidate for deployment at a hospitals perimeter (Stauber, 2004). Although there are many types of firewalls deployed today, the stateful firewall is often best suited for the hospital security due to its ability to track communications and the use of continuously updated state tables. Once the type of firewall has been chosen for the hospital perimeter, we must ensure that it is configured correctly so it performs the security that is expected. The first and most important step in securing the firewall is to turn off all unneeded services.

12. These unused services could be exploited and therefore are an easy step to increase the security at the perimeter. Another best practice which is often overlooked is changing the default settings. Defaults settings on things such as passwords, Simple Network Management Protocol (SNMP), services, and http are a few things if not changed can be exploited. Often a firewall is put in place with many of the default settings which makes it an easy target for potential hackers. Another important step in configuring the perimeter firewall for security is to disallow device management from the outside or untrusted interface. By not allowing the device to be managed from outside of the network, we help to protect the device from being compromised and reconfigured. Security must be considered during the initial configuration of the perimeter firewall to help secure the hospital network.

13. When considering the perimeter security of the hospital, network architecture is key. One mechanism that should be considered during the design for the network perimeter is the use of Network Address Translation (NAT). Although there is no security in obscurity, by using NAT at the perimeter we help hide the internal network therefore increasing security at some levels

14. Don’t allow communications to be initiated from the outside or un-trusted interface. If it is necessary to make servers and devices available from outside, it is recommended that a Demilitarized Zone (DMZ) network be deployed or secure tunnels be used for these devices.

15. The use of a DMZ network gives the ability to access devices without allowing outside devices onto the enterprise network. With this being done, if a device on the DMZ network is compromised, its effects on the hospital’s core network are contained (Wilson, 2002).

16. Although this is by no means an exhausted look at the perimeter design in a hospital, it is a look at a few steps that will help increase security. An additional aspect of the perimeter firewall that must not be overlooked is Intrusion Detection Systems (IDS) and monitoring. Although many firewalls today offer integrated IDS, they are often underutilized or not used at all. If an IDS is integrated in the perimeter firewall, it must be properly configured to be effective. Sufficient time must be taken to ensure that this mechanism is working. Once the IDS is properly configured, it must be monitored. Often an IDS is put in place and never thought about again. An IDS is only effective if it is properly monitored and the data collected is analyzed, so we must implement procedures for this monitoring. With today’s firewalls offering integrated IDS, it must be properly utilized and monitored to help secure the hospital perimeter.

17. An additional aspect of hospital perimeter security which must be considered is Remote Access. In today’s hospital, remote access is a critical part of daily operations so steps must be take to secure this access while still allowing for normal operation. Various devices that are included in this remote access are things such as Virtual Private Network (VPN) concentrators, VPN routers, Dial-In Servers, and many others. Because these remote access devices are acting as a gateway to our network, we must ensure that they are secure (Convey, n.d.).

18. There are many aspects that must be taken into consideration when securing remote access gateways. Many of the principles and practices used to secure perimeter firewalls must also be applied to remote access devices. Some differences in firewall and remote access security consideration given to access control and auditing must. Because the traffic is coming from different sources outside of the hospital, great detail must be taken to ensure that the users are authenticated and this access is audited (TLC, HIPAA, Overview, n.d.)

19. One way to help with remote access authentication and auditing is to centralize administration. By using a centralized source for authenticating and logging, processes are streamlined and become more efficient. If users only have to be added in one place and logs can be viewed in a single place, administration of remote access is made easier and less likely to security vulnerabilities due to missed configuration or unviewed logs.

20. One way this could be done is with a device such as Cisco Access Control server. This server gives the ability to do Authentication, Authorization, and Accounting for remote access in one central location. So although many of the security concerns addressed with firewalls can also be used with remote access devices, due to HIPAA as well as general security practices, great care must be taken when authenticating, authorizing, and accounting for remote access (Cisco Secure Access Control, n.d.)

21. In today’s hospitals, things such as Internet connectivity and Remote Access are vital to daily operations. This importance along with the vulnerability of these devices require that they must be configured, placed, and monitored properly to help ensure they do not become a security liability to the hospital. Also, when designing security at the perimeter, consideration must also be given to things such as fault-tolerance and attack postures (Lundell, 2001). Although it has often been thought in the past that if a firewall is placed at the perimeter the hospital is secure, other aspects must be considered when designing, implementing, and maintaining a secure hospital perimeter.

22. Often network segmentation is only considered in the hospital network when designing the network for efficiency and not security. Network segmentation can play a huge role in the security of the hospital wired infrastructure. By using segmentation, security can be achieved through things such as path isolation and increased number of security boundaries. So although segmentation is necessary for an efficient network infrastructure, it can also be used to help secure the network. Once thought of only as ways to isolate broadcast and to increase network efficiency and resiliency, Virtual Local Area Networks (VLANs) can be used to help secure the wired network infrastructure. By segmenting devices into separate VLANs on the hospital switches, the opportunity for security boundaries is increased. While devices on the same VLAN may have unrestricted access to each other, things such as Access Control Lists (ACLs) and firewalls can be put on the edge of the VLANs to restrict access to other VLANS therefore giving the opportunity for more security (Network Segmentation, n.d.). With this type of segmentation, things such as different departments, equipment, data centers, etc. can be restricted at the edge of the VLAN creating security boundaries. One area of a hospital that requires this type of Layer 2 isolation is Radiology equipment. Much of this equipment lacks the ability for protection at the endpoint so the network segment on which it resides must be secure. The use of VLAN segmentation allows for the restrictions to be applied closer to the source, therefore being more effective (Virtual LAN Security, n.d.).

23. Another aspect that must be considered when designing network segmentation to increase security is path isolation. Often traffic is segmented on the Layer 2 network through the use of VLANs but is often mixed together once it passes through a layer 3 device such as a router. Care must be taken to ensure that certain traffic is isolated on both the Layer 2 and 3 network segments. One case in where this would be necessary would be “guest access”. This traffic should be segmented and completely isolated from hospital traffic throughout the network to ensure security. At no point in the network should this type of traffic be inter-mixed with hospital traffic. This can be achieved through design strategies such as network virtualization. By using network virtualization, complete traffic isolation can be achieved at both Layer 2 and Layer 3 network segments.

24. By using traffic isolation throughout the hospital network, another layer is built into the wired network security architecture. Although things such as network segmentation and isolation are often burdensome to design and implement, they can prove to be a great asset in the wired network security of any hospital. As stated by Olzak (2006), “at a minimum, network segmentation should result in a production segment and a restricted access segment” (pg. 1). As networks and the devices that they contain become more complex and diverse, great efforts must be taken to segment, isolate, and secure different traffic as it traverses the wired network.

25. In many hospital environments, great care is taken to design security at the perimeter while network access control on the internal network is often overlooked. Network access (or admission) control is allowing or denying network access based on predetermined criteria. This type of access control is often only considered in the context of things such as wireless networks and remote access. It is not until recently that network access control is becoming popular on the switch port level within the hospital’s wired infrastructure.

26. The most well-known and implemented piece of network access control is Identity Based Network Services (IBNS) and 802.1x. The IEEE (2004) offers the following description for network access control and 802.1x standard: Port-based network access control makes use of the physical access characteristics of IEEE 802 Local Area Networks (LAN) infrastructure in order to provide a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connection characteristics and of preventing access to that port in cases in which the authentication and authorization process fails.

27. So 802.1x gives the ability to allow network access based on credentials supplied by either the user or the device. This offers the ability to allow network access only to legitimate users at the front line, the switch port. Often, in many environments, everyone is allowed access to the network and access control is placed on devices such as servers. By pushing this access control to the port-level on the network, the security of the overall networking environment is increased because only authenticated devices or users are allowed access to the network (Meador, n.d.). With much of today’s security threats coming from inside of the network, this type of access control gives the ability to authenticate users on the front line and help to increase the overall security of the core network.

28. Another aspect of network access control which must be considered is the security posture of the device connecting to the network. Often it is not enough to just verify who is accessing the network but what is accessing the network. With systems such as Cisco Network Access Control and Juniper Universal Clean Access, a device can be verified for network access. This verification process can include checks for such things as Antivirus, patches, and other security aspects (Lippis, 2006). By using such systems for network access, the device that is accessing the network can be tested for security compliance as well as the user. This ability to scan the device allows for compromised and un-secure devices to be denied at the edge of the network before affecting the entire infrastructure.

29. In many cases network access control is a very tedious task to deploy throughout a hospital but it can prove to be a major asset in infrastructure security. By authenticating and authorizing users and devices at the port level, potential security threats are eliminated before given the ability to impact the network infrastructure. As stated by Guo and Wang (2005), LAN connections, traditionally considered trusted networks now also require higher levels of security. In fact, internal threats are ten times more financially damaging that external threats. (pg. 281) With many of today’s security threats coming from inside of the organization, this ability is becoming a necessary part of network security and also helping with HIPAA compliance.

30. A network infrastructure is only as secure as the equipment on which it runs. In securing a hospitals network infrastructure, equipment security must not be overlooked. If the equipment that runs the network is compromised, the entire hospital and the data which it contains is left vulnerable, so it is a major piece of the security puzzle.

31. The first thing that must be considered when looking at securing network equipment is access. Who and how access to the network equipment is controlled. HIPAA requires that equipment be housed in a secure location so put the equipment in locked environments wherever possible (TLC HIPAA Overview, n.d.).

32. Also authentication and authorization must also be required for access and management of the network equipment. This is best done through a centralized authentication server such as Radius or TACACS+. Great care must also be taken to secure how the equipment is accessed. Wherever possible, eliminate insecure protocols such as telnet and http and use protocols such as Secure Shell (SSH) and HTTPS. Also, restrict access to only known device IP addresses through access control list. Many network segments and subnets have no need to manage network equipment so deny access from these networks. Wherever possible, use out-of-band management so that normal traffic and management traffic are not on the same segments (Convey, n.d.)

33. Network equipment access security in management is critical to the overall security posture of the network infrastructure. As mentioned earlier with perimeter firewalls unused services must be disabled to help secure network devices. Unused services on network devices are a potential security risk and should be disabled. If the services aren’t used, no functionality is lost but security is gained if the services are disabled. These services will vary depending on the type and manufacturer of the device, but most manufactures document services to disable if not needed. So a good rule of thumb is to know your equipment and what it does and turn off everything else. Also, disable unused ports. An unused port that is enabled can potentially become an entry point for an attacker. So to help ensure the security of the network equipment as well as the overall network, disable all unused services and ports on the network devices (Convey, n.d.)

34. In today’s hospital, increased reliance on the wired network infrastructure has made security a major part of every aspect of design, installation, and maintenance. Every effort must be made to secure the various levels of the network. In the past, network security was an afterthought. In today’s network, it must be a major factor in every part of the network (Cisco Medical Grade Network, n.d.). This paper has given a birds-eye view of some practices to be considered when it comes to the hospital’s wired network infrastructure. As this, or no other single document, is not be considered the key to hospital network security, it offers concepts to serve as guide to increase security and help insure HIPAA compliance.

Reference: Cisco Medical Grade Network

Top Ten Mistakes in IT Decisions On Health Infomatic System..

1. Not Using a Structured Process - Many organizations plunge head first without a clear and structured plan.
   
2. Not Defining Needs Beforehand - The best way to determine which solution will work best for your organization is to identify your needs. To avoid overlooking important functionality, you may find it helpful to start with a good list of requirements.
3. Hiring a Consultant who is Really a Reseller - Many consulting firms not only provide help selecting computer systems, they also act as re-sellers and implementers of enterprise applications. You may not be exposed to all possible vendor solutions, just the ones with whom your consulting firm has an affiliation.
   
4. Paying Too Much Attention to Bells and Whistles - Innovative new product features may seem cutting edge and exciting don’t let it distract you. Concentrate on functionality you will use every day. Most sales reps are adept at dazzling you with fancy features.
   
5. Not Including Key Users in Selection Process - Do not select a solution without soliciting meaningful input from the users. At the beginning of your selection project, form a selection team with representatives from all affected departments. One of the biggest frustrations users face in selection decisions is being sidestepped by the IT department.
   
6. Buying More Than You Need - Without a clearly defined list of user requirements, you’ll tend to buy more functionality than you actually need. Select a system that allows for growth and enhancements--if and when you need them.
   
7. Allowing Vendors to Drive the Process - Vendors are highly skilled at showing you what they want to show you and answering questions the way they want to answer them. To level the playing field, you need a clearly designed and defined selection process that will ensure you receive responses in a standardized format.
   
8. Allowing the “Powers That Be”to Choose the System
9. Confusing the Salesperson with the Product
10. Not Using an RFP Process

Improving quality through effective implementation of information technology in healthcare

In 2003, two Stockholm hospitals 40 km apart merged to form the one Karolinksa University Hospital. Interviewees reported that there was a need to form a common EMR to increase integration and allow communication between the two sites, and, ultimately, other services.

Three independent appraisal studies were carried out. The reports were made to one session of heads of department: interviewees describe a ‘defining moment’ when the chief medical officer asked for a ‘show of hands’ from the group about which system should be adopted, and nearly all voted for one system. The meeting recommended that all departments at one site (Solna) would move from five different types of medical records to the one system used by the other site, and this was accepted by top management.

The new system would need to be installed in 40 clinics with 7000 users at the Solna site. Some new hardware had to be installed, as well as considerable changes to software. The new system contained patient administration, clinical medical records and referral- and replies to referral information, but it was not an entirely paperless record: there were still many documents such as EKG and ‘pictures’ (e.g. radiology).

Analysis of documents and interviews show four key choices, which were confronted and made before implementation, all related to making the key main change within 1 year using limited internal implementation capacity, and delaying other changes to later phases. The first choice was about the extent to which top-level management and the IT department should prescribe the system and its details, and how much and what type of independence the departments should have.

The preparation process involved the departments, and top leadership made the timetable and managed the project tightly, but departments could choose at what time during the year they would implement and some of the details of the screens which would be created by the hospital IT department.

The second key issue was whether to use an outside implementation service or use the limited in-house resources for implementation. The solution was to manage the project internally, phase-in the change over time, and to use external consultants for specific changed which needed to be made. This was possible because of a third choice and decision, which was not to attempt to implement computer physician order entry (CPOE) to order medications at the same time but to phase this in after the EMR and in the following year.

The disadvantage was that some departments would loose CPOE, which was functional in the current system. The fourth choice was not to implement functions which different departments needed for research during the EMR phase, but to modify the EMR in the second year to allow this.

Project process to introduce the EMR

Once the decision was made in 2004 about which system to introduce, interviewees reported that senior leadership made it clear that departments only had choice about small screen modifications and their date for implementation in 2005. Each department was required to nominate staff internally to form a department project group to work with the information technology department to fine-tune the system for the department and carry out implementation. During 2005, all clinics had the same interventions from the project members and the plan was almost exactly followed.

Effects of the system on personnel and work

An analysis of the interviews carried out half way through implementation (June, 2005) through to 3 months after implementation (March, 2006) identified common themes that are listed below and illustrated with typical quotes from informants. Approximately 95% of the comments were positive about the implementation process and the new system.

The relatively successful Karolinska implementation could be due to:

1. Consultation before implementation
2. Consensus about a need for the system and which system was best
3. Prioritzation and ‘driving’ by management team
4. Competent IT project leader and team
5. Tested, user-friendly and intuitive system needing little training
6. Potential for development of the system
   
7. Medication order entry not difficult to integrate after implementation
   

The evidence from this and other research is that an EMR designed to meet many different needs often does not meet local clinical work needs, is more difficult to implement, and can reduce productivity and access to information critical for patient care and safety.

A new system will need to have benefits which significantly outweigh these disadvantages and which are clearly communicated, if it is perceived to be less user-friendly and requires extra time for operation, which is often reported to be the case in previous research. Time and resources will be needed to develop the system.

Practical implications

In this study, the comparison with other research suggests general lessons for others implementing an EMR system in a hospital:

1. Choose a system which allows a range of needs to be met and is a tried and tested in a similar setting,
2. The overriding choice criteria should be a system that works for clinical personnel and saves time. Resistance is not always irrational. If personnel do not think it is easy to use and will save time then implementation will be significantly more difficult and possibly impossible.
3. The system should be intuitive, requiring little or no training,
4. The system should be easy to modify and develop, within limits, for different departments and uses.
5. The decision about the system should be participatory, but once made, implementation should be directed and driven.
6. Balance local control of selection, implementation and clinical participation with meeting higher-level requirements.
7. Involve each level in different ways, with clear and appropriate parameters about which decisions can be made locally and which require higher-level decision about common standards.
8. Assess and address the presence and absence of prior and concurrent factors, which have been repeatedly shown in research to help and hinder implementation.

Conclusions

Health services do not have a good history of cost effective implementation IT and especially of EMRs. The potential for increasing safety and productivity of this ‘quality intervention’ is largely unrealized. The study of EMR implementation presented in this paper was carried out using the same case study method of an implementation in the USA. After reviewing previous research, the research team expected the EMR planning and implementation in this study would follow the same problematic pattern of other implementation.

The findings of the research team, who were entirely independent from the hospital, were unexpected and contrary to most previously reported research: the Karolinska implementation was successful, on time and within budget.

Empirical data of respondent’s perception of what helped and hindered implementation show a consensus about the main ‘helping’ factors. These were the local hospital control of selection of the system, employee involvement in many different ways, leadership and support by a competent on site information technology department, and decisive and full leadership backing.

The Karolinska experience suggests that a tried and tested EMR, which is accepted by physicians can be implemented successfully in 1 year into a teaching hospital with some experience of computerization. It did not show whether such a system allowed the clinical work and process redesign, which some thought necessary and as a missed opportunity during the implementation

Other findings about what helped and hindered were derived by comparing interviewee data to a simple implementation theory developed from a review of previous research. The findings from this revealed the importance of organizational, leadership and cultural factors, as well as a user-friendly EMR, which assists clinical work, is easily modified and which saves time and increases productivity.

This theoretical model for successful implementation is based on a review of research and supported by the evidence of this study. It provides a theoretical basis for future research and a practical tool for implementing an EMR and realizing the potential of this method for improving safety and the quality of patient care.

(Source: International Journal for Quality in Health Care; Volume 19, Number 5: pp. 259–266, 23 August 2007)

Knowledge and Perception of the Staff of Pandan Hospital Regarding Total Hospital Information System

Pandan Hospital was the third hospital using Total Hospital Information System (THIS) in Malaysia after Selayang and Putrajaya Hospital. This 704 bedded hospital is located about 15 kilometers from the center of Johor Bahru City, It will be the first hospital in the southern using THIS.

THIS is designed to automate the care delivery process in hospital through the process of integrated clinical, imaging, financial and administrative system. A study of knowledge and perception regarding THIS among the staff posted to Pandan Hospital was held.

The objective of the study is to determine the knowledge and perception of the staff of Pandan Hospital regarding THIS. A total of 131 respondents with 55.7% of the respondents were staff nurse. Less than 50% of the respondents requested to work in this hospital.

Among those who requested, almost 60% said that they were interested with IT hospital. Almost 90% of the respondents had minimal computer knowledge and 96. % was very interested or interested with Information Technology (IT). Most of the respondents had superficial knowledge about THIS by saying that THIS was about computer and linkage, IT and paperless hospital.

The perceptions toward THIS were good, where 58% said it was a better, systematic and quality system, 16% said modern and advance and 5.3% said that the system had both good and bad effect. Majority of the respondent said that THIS would benefit to both patients and staff.

Interoperability challenges with imaging systems in John Paul II Hospital, Krakow, Poland

Among the main lessons learned during digital imaging implementation and system integration at John Paul II Hospital in Krakow, Poland, were interoperability issues. According to Zbigniew Les from the hospital, “only with closely integrated ICT systems throughout the hospital, the full imageenabled medical electronic patient record can become reality”. However, while extending the ICT network within the hospital and interconnecting it with the systems of other institutions, the hospital faced interoperability problems. Due to a lack of interoperability, John Paul II Hospital cannot take full advantage of the technology in place to extend its usage outside the campus.

On the one hand, “there are still too many versions of software that are not compatible within the sector causing difficulty to exchange data”, Mr. Les said. A lack of state regulation is a further reason: “The process of system integration within the hospital and with other institutions, for example the National Health Fund, is hampered by a lack of clear state regulation about electronic data storage and exchange as well as a lack of standards for exchanging medical information.” Consequently, beside technical solutions, “the involvement of policy makers is equally important to bring clarity and impose some common solutions for the healthcare sector”.

Currently, large institutions with competitive advantage such as John Paul II Hospital impose their solutions to others, Mr Les explained. This may lead to several competitive standards. Their coexistence may result in unnecessary complications for the users and may make the creation of interoperable solutions at the national level more difficult.

Source: European Commission, Enterprise and Industry DG (2007b), p. 116.

ICT standards consolidation to overcome interoperability problems

Standards are key to interoperability because they provide the specifications which are necessary for systems to communicate meaningfully with each other. From the perspective of the buyers and users of healthcare ICT – for example general practitioners or ICT managers in hospitals, community care centres and insurance funds – interoperability problems may arise because of various shortcomings of e-health standards and standardisation.

These may include a large number of conflicting standards on the one hand but too few or insufficiently developed standards for particular solutions on the other hand. From an ICT industry perspective, there is a lack of sufficiently specified and commonly used ICT standards that meet user needs.

Consequently, a solution for the ICT interoperability challenge in the health sector may be the common use of a more confined number of well-developed and harmonised standards. This may in short be considered as “standards consolidation”. Standards consolidation is easily stated as an objective but difficult to realise. Numerous standardisation organisations, governments, and enterprises with diverging interests are struggling to maintain or gain power in defining ICT standards for the health sector. The number of standards used and the number of organisations involved in defining standards is very high and almost impossible to overview.

The complexity of the area of ICT standardisation itself is an important barrier to reach the objective of standards consolidation and even to decide where and how best to tackle it. Structuring the area of e-health standardisation and thus reducing this complexity is a key objective of standardization.

Healthcare Interoperability: the big debate!

Are international standards the most important factor in healthcare interoperability?A reader poll ahead of the Healthcare Interoperability conference in Birmingham decided that they were. But what would expert debaters and their audience think on the day? Fiona Barr reports.

Are international standards the key to long-lasting success in healthcare interoperability - or are they sometimes doing more harm than good? That, essentially, was the question posed by those speaking in the debate at E-Health Insider’s Healthcare Interoperability conference in Birmingham.

For the motion

Paul Woolman, ehealth information architect in the ehealth directorate of the Scottish Government, proposed the motion that: “This House believes that international standards are the most important factor in achieving interoperability in healthcare.”

He argued that interoperability is not only about achieving the technical transfer of data, but also about ensuring that the clinical meaning is understood. To get that to work, successful international standards are essential, he said. “You can do things with local solutions but to do things that last for a long time you need international standards,” he added.

His view was backed up by Philip Scott, a board member of HL7 and head of IT projects and development for Portsmouth Hospitals NHS Trust.

Scott argued that standards were not a bar to life in the real world and standards such as those used in debit cards were proof that international standards could work. “Standards have to be international because vendors are operating in a global market,” he said.

And against

The case against the motion was put forward by Martin Strange, head of health IT at Lloyds Pharmacy. Strange said he believed that some standards were “the greatest impediment” to interoperability and that open, national standards were much more important. He said these could retain flexibility while delivering functionality and: “We need that flexibility.”

Strange was backed by Ian Herbert, an independent health informatician and vice-chair of the British Computer Society’s Health Informatics Forum.

Herbert argued that international standards are not developed in a coherent manner and not always developed by the most appropriate people to do the job. He also said features that were relevant to the US were not always relevant in the UK - and vice versa – while international standards were difficult to change and complex to maintain.

“What actually matters is reliable and consistent use of standards, and international standards don’t make this any easier,” he said.

Open for debate

The four debaters were questioned about the commercial impact of different standards on suppliers who want to market their software worldwide.

Woolman said there was evidence from the medical devices market of big companies being willing to work together on standards to try and defer some of the costs - which could then benefit smaller suppliers.

But Herbert argued that while international companies liked to work to international standards this could also be a bar to innovation among smaller companies. He said that, for example, the cost of getting products tested by NHS Connecting for Health, the agency that runs the National Programme for IT in the NHS, could be prohibitive. “Some of these complex standards are actually doing some harm as well as good,” he said.

Dr Mary Hawking, a GP in Bedfordshire, asked whether international standards should be introduced for information itself, given that healthcare interoperability was all about moving patient data around.

Scott responded that clinical practice differed across the globe and that achievement would have to be limited to some sort of summary, highlighting the proposals for a European health record summary.

Others in the audience suggested that introducing standards for clinical content was critical before anything else was tackled. The newly-published standards developed by the Royal College of Physicians were welcomed as a good first step. “Unless we address the clinical content we have nothing to convey,” one doctor said.

Summing up for those supporting the motion, Woolman said national standards were never going to be enough. “Medicine is an international business. Companies work internationally. They want to use international standards. International standards have to be used in the long term,” he said. However, the motion was lost by just one vote.

(Source : http://www.ehealtheurope.net)