Attestation verses Certification for HISPs

Of all the Meaningful Use Stage 2 questions I'm asked by vendors, HISPs, and providers, many involve confusion between certification and attestation.

As I've written about several times, the certification criteria are so extensive, often in unnecessary and confusing ways, that few vendors have been able to get through them.   Certification criteria exceed attestation criteria in many scripts.

I was recently asked about transition of care data exchange using Direct and the need for message delivery notification (MDN).   Micky Tripathi wrote the following excellent analysis, the bottom-line of which is that MDN is a narrow certification criteria, not an attestation requirement.   In the future, I think certification must be simplified to include the bare minimum necessary to support attestation.     Many people on the Standards Committee feel the same way and we'll support whatever polishing strategy ONC deems appropriate.

Micky wrote:

"1)  Organizations with self-developed systems may depend on a HISP as part of their certification, but organizations with vendor-based EHRs will not
a.   Although organizations with self-developed systems may chose to use the HISP as part of their alternative certification, most organizations will rely on their EHR vendor's complete certification
b.   For example, for Beth Israel Deaconess Medical Center certification, the HISP, acting as modular certified technology, needs to generate MDNs in response to incoming messages.
c.   For everyone else, the HISP does NOT need to generate any type of MDNs.  Sending providers only need to have reasonable assurance that messages sent via the HISP have been delivered to the intended recipients.

2)      There are three requirements that are relevant here:  the transitions of care attestation requirement, the technology certification for receiving messages, and the technology certification for creating/transmitting messages:
a.       The Meaningful Use Stage 2 transitions of care attestation requirement is that “the summary of care record must be received by the provider to whom the sending provider is referring or transferring the patient” (see page 4 of the measure)
b.      2014 Edition certification requires that an EHR be able to receive a Direct-compliant message and send an MDN for successfully received message (see page 5 of the NIST test script)
c.       2014 Edition certification requires that an EHR be able to transmit a Direct-compliant message to a Direct address recipient.  There is no MDN requirement on the transmission certification.  (NIST test script).

3)      The MDN requirement is SOLELY a certification requirement (it is NOT an attestation requirement) and it applies only to the requirements regarding receiving messages.  There is no certification requirement for MDN in transmission transactions.  There is no attestation requirement for MDNs (or any other technical means) to demonstrate assurance of receipt of transmitted transitions of care.
a.     While attestation does require that the intended recipient actually receive the message, there are no requirements on what type of assurance the sending provider must have in order to meet the Meaningful Use transitions of care measure.  Indeed, the ONC commissioned white paper on the topic of assurance states that:  “It is up to the Certified EHR Technology vendor to determine how to assist its customers and provide them with assurance that transmissions have reached their intended recipients.  This assurance could include a presumption of success on the provider’s part of subsequent transmissions if they have reasonable certainty that initial transmissions were successful.”  (see page 2 of the white paper)

4)      The MDN issue thus applies only to organizations that are using alternative certification and using the HISP as relied upon software because they need to be able to meet the “receive” and “create/transmit” criteria.  It does NOT apply to users who are using off-the-shelf Certified EHR Technology to transmit Direct messages over the HISP.
a.      Any other organization with off-the-shelf Certified EHR Technology which wants to use the HISP for transitions of care transmission does NOT need the HISP to be certified
b.      Their own Certified EHR Technology will generate a Direct-compliant message and pass it to the HISP for delivery
c.       The sender will have met their transitions of care requirement at this point as long as they have reasonable assurance that the HISP delivered the message to its intended recipient
d.      This assurance could be provided by MDNs delivered back from the receiving EHRs, but it does not have to be, and indeed, since recipients are not required to be Meaningful Use compliant, many recipients won’t be able to generate an MDN anyway
e.      In any case, it is NOT a HISP responsibility to generate and transmit MDNs back to the sending EHRs (except in the case where the HISP is acting as relied upon software for alternative certification)

5)      Some organizations may want the HISP to be certified for their attestation purposes.  For the purposes of attestation, the HISP will be certified ONLY for “generate/transmit” and NOT for “receive”, and thus it has no obligation to create MDNs
a.       In order for the HISP to receive modular certification for “receive”, it would have to be able to display CCDA documents, accurately match patients, and consume structured information for medication, problems, and medication allergies.  That would require that the HISP to include EHR features beyond the scope of HISP operations.
b.      Any organization that would like to attest with the HISP could thus only use the HISP for the “generate/transmit” requirement.

6)      Regardless of whether the HISP is used as just a conduit (#4) or as a certified module for transmission (#5), the HISP does need to provide some type of assurance of delivery back to the senders
a.       The current plan for the Massachusetts State HISP is to send back MDNs to provide assurance of delivery, which is ideal – however, it is NOT required
b.      The HISP could assure delivery by contract such as a service level agreement
c.      And/or the HISP could make available transaction audit records back to senders periodically or on-demand"

Dispatch From a Mysterious Island

Whenever I travel on business, I try to take a few hours to explore the road less traveled.   Whether that's climbing Mt. Fuji, hiking the Aonach Eagach ridge in Scotland, or crossing the Baltic Sea in a kayak, there's always an adventure to be found.

During my current Asia trip, I sought the help of several friends in Japan to arrange the trains, planes, and boats that would bring me to the shores of Yakushima, Japan's first World Heritage site, to explore the island's cloud forest and volcanoes.   Some of my colleagues who've heard about Yakushima, call it The Mysterious Island after the Jules Verne novel of the same name.

If I were to design the perfect Mysterious Island, here are the characteristics it would have:

1.   The approach should be difficult and ideally involve a small plane flying through miles of cloud cover with no visibility.    Check, did that.

2.   Ideally, crossing an active volcano should be involved.   Check, did that.

3.   The forest should be ancient, filled with giant trees over 5000 years old.   Check, Yakushima is filled with Yaku-sugi, cedar trees that are thousands of years old with circumferences exceeding 30 feet

4.   Make it wet so that the entire forest is covered with moss and waterfalls.   Check, Yakushima has the highest rainfall in the world, over 30 feet per year.

5.  Put it in the track of many typhoons to make staying there exciting.  I just flew from the island into Typhoon Wipha - the photo below shows the swirling vortex of the storm creating a strange split level sky.  My hiking clothes are saturated despite total body Gore-tex.

6.  Make it dark and misty with 6000 foot cloud-covered peaks topped with snow in the winter.   Check, here are a few shots of the cloud forest I hiked.

7.   Fill it with unusual animals, insects, and birds that are found nowhere else in the world, including miniature deer and walking sticks that look like a cross between a centipede and spider.  Check.   It also has leeches, giant hornets, enormous spiders, venomous centipedes and poisonous snakes

8.  Add monkeys, it must have monkeys.  Check.  Yakushima has its own species of Macaque Monkey

9.  Give the plants an almost human look with long finger-like roots. Add vines and exotic flowers.  Check.

10.  Add forest spirits.   Admittedly, that only happened in the movie inspired by Yakushima, the Miyazaki anime called Princess Mononoke.   Almost check.

My visit to the Mysterious Island included 20 miles of hiking/climbing with a 6000 foot elevation gain including scrambling over moss-covered rocks during a typhoon.  I stayed in a wonderful place called  Wa no Cottage Sen-no-ie  handcrafted of cedar.  I highly recommend staying there if you visit.  The people who run it are remarkable and speak English.

I think a visit to Yakushima qualifies as the road less traveled.   Priceless.

Building Unity Farm - Reflections on our First Year as Farmers

While I'm traveling in Asia, my wife Kathy is running the farm, ensuring that all our animals are healthy, our last few harvest duties are done, and our preparations for winter have begun.

Before I left, I did everything possible to minimize her tasks.   I installed heating panels in the duck house so that she could move the duck babies from the brooder to the outside world.   I harvested mushrooms from all our fruiting logs.  I added yeast and nutrients to our fermenting apple cider.  I secured all our gates, cleaned the barn, and finished moving all our building materials into the hoop house.

Thinking about the past year, we're well on our way to a productive, self-sustaining farm.  Here's a status report

Mushrooms - we've gathered our first 25 pounds of oyster mushrooms from 144 poplar logs stacked in two forest locations.   We've finished inoculating Shitake spawn into 165 oak logs housed in the shade house plus 110 logs in the forest.   We've inoculated 10 logs with Lion's Mane.   Next year we should have commercial quantities of mushrooms to sell.

Bees - Our 8 hives built up their honey stores all summer , despite our harvesting of 160 ounces.   Our queens are healthy and the bees are disease free as we head into winter. Given the strength of our hives, we should substantial honey harvests next year.

Apples - we've placed an order for additional trees to add to the orchard in 2014
3 Kingston Black
1 Ashmead's Kernel
1 Newtown Pippin
1 Golden Russet
2 Wickson's Apple
1 Nehou
1 Baldwin
1 Blacktwig

bringing our total to 40 apple trees.   This year we crushed 250 pounds of apples and fermented enough juice for 75 bottles of still and sparkling hard cider.  Above is a look as the fermentation in progress.   In five years, we'll have nearly 7000 pounds of apples per year for eating, selling, and cider making.

Blueberries/Raspberries/Elderberries - our planting of 180 high bush/150 low bush blueberries and placement of permanent bird netting is complete.   The blueberries already yielded a few pounds, but we should have hundreds of pounds within a few years. The raspberries and elderberries should begin producing next year.

Alpaca/llama - Our 11 alpaca and 1 llama are in perfect health.  Two are pregnant.   They understand the routine of monthly "herd health" checkups and trust us to handle them with respect and gentleness.  The barn is fully stocked for winter with all the hay we need to last until next hay season.

Poultry - our 11 chickens, 31 guinea fowl (11 adults and 20 babies), and 10 ducks are completely adapted to their surroundings and the routine of going into their coops at night for protection.    Pecking orders are established, and our poultry community lives in harmony, eating wild foods throughout our 15 acres every day.   Our baby ducks are shown below.

Dogs - Our two Great Pyrenees are now fully grown and protect all our animals.  Admittedly since they weight nearly 200 pounds together, running with them (I weigh 165) can be an adventure

Hoophouse and Vegetable Garden - Our year round indoor and outdoor vegetable gardens are now complete along with watering, fertilizing, and harvesting infrastructure.   We'll grow lettuce, kale, and spinach all winter long.  Next spring we'll plant enough crops to supply half our food.

It's been a great first year on the farm and the daily activities caring for the animals/plants has become so integral to our lives that travel away (like my current responsibilities in Asia) seems completely out of balance.

Dispatch from China

This week I'm in Asia providing advice to government, academic and industry leaders about leveraging IT investments to accelerate quality, safety and efficiency policy goals.

I flew from Boston to Beijing on Monday to Tuesday and met a team of Chinese industry leaders on Tuesday evening to discuss their plans for smart cities, home care, and wired hospitals.

On Wednesday, I joined several colleagues to celebrate the opening of a new state of the art ambulatory care facility for women and children.  They are implementing EHR products to automate clinical and administrative workflows including provider order entry.   Mitch Rabkin and I keynoted a conference describing the US experience with healthcare reform and healthcare IT reform.

On Thursday (I'm a day ahead because of the 12 hour time change), we met with central government officials including the health minister of China.   We discussed a collaboration that would enable US and Massachusetts experiences to inform Chinese healthcare policymaking.  Of particular interest to them is our HIT Standards and Certification program to enhance care coordination, patient/family engagement, and population health.   As I wrote about yesterday in my post offering advice to the new national coordinator, I look forward to considering the revisions needed in our regulations to highlight the good and minimize the burdensome.   We have a great opportunity to apply our revised regulations to 1.3 billion people in China!

On Friday, we'll run a symposium on healthcare IT and care management in Hangzhou.   On Saturday we'll have meetings with government leaders in Shanghai.

Then on Sunday, I head alone to Japan for the next phase of my trip, serving as guest professor in Kyushu, the southern part of Japan and keynoting in Taiwan before returning to Boston.

One of the great aspects of working in Asia is that the 12-13 hour time change enables me to have a full day with colleagues in China/Japan/Taiwan then have a full day with colleagues in Boston.   Keeping a 24 hour a day schedule for two weeks will require a bit of recharging, so while in Japan I am taking a day to climb 6000 foot volcanos and hike the wilderness of Yakushima island, one of the great ancient forests in the world.   As I dash from Asian city to Asian city, my carry-on baggage contains my full body Gore-tex, enabling me to tackle the 10 meters of annual rainfall in the wettest location of Japan.   Probably the only downside to the remarkable beauty is the predominance of giant leeches.    You only live once.   I'll post pictures.

Advice to the Next National Coordinator

Over the next few months, Jacob Reider will serve as the interim National Coordinator for Healthcare IT while the search continues for Farzad Mostashari's permanent replacement.

What advice would I give to the next national coordinator?

David Blumenthal led ONC during a period of remarkable regulatory change and expanding budgets.  He was the right person for the "regulatory era"

Farzad Mostashari led ONC during a period of implementation when resources peaked, grants were spent, and the industry ran marathons every day to keep up with the pace of change.   He was the right person for the "implementation era"

The next coordinator will preside over the "consolidate our gains" era.   Grants largely run out in January 2014. Budgets are likely to shrink because of sequestration and the impact of fiscal pressures (when the Federal government starts operating again).    Many regulatory deadlines converge in the next coordinator's term.  The right person for this next phase must listen to stakeholder challenges, adjust timelines, polish existing regulations, ensure the combined burden of regulations from many agencies in HHS do not break the camel's back, and keep Congress informed every step of the way.    I did not include parting the Red Sea, so maybe there is a mere human who could do this.

What tools does the coordinator have in an era of shrinking budgets?

At present, Meaningful Use Stage 2, ICD-10, the Affordable Care Act, HIPAA Omnibus Rule, and numerous CMS imperatives have overlapping timelines, making it nearly impossible for provider organizations to maintain operations while complying with all the new requirements.  

Can resources be expanded? Given that Medicare/Medicaid reimbursements are falling, private insurance payments are nearly flat, and costs continue to escalate, the pie of resources is a fixed size and very challenging for anyone to expand.  

The new coordinator has only two levers - reduce scope or extend time.

Changing the scope of initiatives already in progress may be very challenging i.e. require acts of Congress, realignment of powerful stakeholders, or compromise of the important interoperability goals we've worked so hard to craft.

That leaves "time" as the one lever under the coordinator's control.  However, even revising schedules will be challenging because of competing stakeholder demands.  

a.  ICD-10 - although some large organizations have significant sunk costs and want the deadline to remain as October 1, 2014, smaller organizations will not be ready.   Some payers (including government payers) may not be ready.    It's clear we need to extend the deadline at least 6 months.    Maybe encourage voluntary ICD10 transactions on October 1, 2014  but allow a 6 month grace period without regulatory enforcement for the industry to catchup with the software, training, and process change needed for ICD-10 success?

b.  Meaningful Use stage 2 - Software products are still being certified, so many hospitals and professionals have not yet upgraded to Meaningful Use Stage 2 certified applications, making a 2014 reporting period/attestation somewhat challenging.   Meaningful Use Stage 2 reporting periods have already begun for hospitals, so no delay is possible, but the reporting period timeframe could be extended.   Maybe provide an 18 month window for Stage 2 attestation?  I realize this could delay future stages of Meaningful Use, but the industry needs a breather to consolidate our gains.

c.  ACA - the Affordable Care Act has motivated many organizations to focus on continuous wellness rather than episodic sickness.   ACOs are building private data exchanges and outcomes registries.  Progress is accelerating because every dollar spent on IT has the potential to reduce costs in risk-based contracts.  ACA and private insurer equivalent programs (such as the Blue Cross Alternative Quality contract) include many quality measures.  Unfortunately, these measures are not optimized for the EHR era and are retooled from a time when quality measurement was done by abstractors in health information management.    Rather than escalate already burdensome quality reporting requirements (BDMC produces over 1000 measures per year for various regulatory agencies), shouldn't we step back and ask what measures are truly important and urgent in a fully electronic era?   Reducing reporting burdens temporarily while s a consolidated set of new electronic measures is developed would be very helpful.

d.  HIPAA Omnibus Rule - audits require at least 10 operational hours for every auditor hour.  While hospitals and practices are in the midst of enhancing policies, revising infrastructure, and learning about the operational implications of the Omnibus Rule, it would be prudent to slow the pace of audits, just temporarily.  We all want to protect privacy and reduce risk but there is a fixed rate at which organizations can integrate change.   We need to focus on the long term and build a robust multi-layered defense.   At times in the past, we've moved faster with regulations/enforcement than standards and technology maturity could support.

e.  Some have suggested that if industry does move fast enough, more regulations will cause stakeholders to move faster.   I really believe that more regulations will be a case of haste makes waste.   Let's integrate existing regulations into the fabric of our operations, using the market forces created by the accountable care act to align incentives, and only consider new regulations when we have enough information about the impact of prior regulations.    Although challenging, maybe the coordinator could even consider polishing existing regulations to reduce the artificially burdensome aspects which are not necessary to achieve policy objectives.  I'd start with taking testimony about the certification scripts for view/download/transmit, transitions of care, quality measurement, automated numerator/denominator, and clinical decision support.

Jacob Reider will do a great job over the next few months and could become the permanent coordinator.   I will do everything in my power as co-chair of the Standards Committee to support whatever scope and timing revisions the coordinator considers.

Building Unity Farm - Creating the Hoophouse

This summer, as we cleared land for the orchard, we graded a level surface for a 21x48 foot hoophouse to extend our growing season and enable us to produce greens for our table and the animals year round.

We purchased the steel for the structure from Ledgewood Greenhouses in New Hampshire and sought the help of River Valley Fencing to build it.   Although we built the 10x30 foot shade house for mushroom cultivation ourselves, creating the 21x48 foot structure required tools and equipment we do not have.

The back of the structure is T-11 plywood.  The front is lucite.   The top is a 6 millimeter UV resistant plastic that lasts about 5 years.

Inside the hoophouse, we built 16 raised beds - 87x48x12" so that we have room for 2 foot aisles.

We dug a foot deep foundation underneath the raised beds and filled it with 12 cubic yards of composted alpaca/llama manure (we have plenty).   When then filled the raised beds with a combination of compost, moss, and vermiculite.

The hardest part of project was creating a water supply that would work in the winter.   We dug a four foot trench from our well equipment to the hoop house and attached a yard hydrant http://geekdoctor.blogspot.com/2012/07/cool-technology-of-week.html with a 4 foot burial depth.    Since the frost line in Massachusetts is 36-42 inches, water will flow throughout the year, even in the depth of winter.   We also ran an electrical line in the same trench to power the temperature controlled fans in the hoop house.

Next week we'll plant our Fall/Winter vegetables - lettuces, spinach, kale, chard, and  garlic.

As we approach the end of 2013, the building phase of the farm is coming to an end.   We've finished the hoop house, the mushroom growing area, the orchard, the cider house, and the duck house this year.   We're now ready to spend the next 30 years growing, learning, and using everything we've created.

I've never considered myself a prepper http://en.wikipedia.org/wiki/Survivalism but if the zombie apocalypse does come, we'll be able to sustain ourselves from the farm around us.

The CareFwd Conference

Yesterday, I joined a panel at the CareFwd conference discussing the innovations needed in healthcare today.

I highlighted 5 areas:

1. Meaningful Use Stage 2
Need novel patient engagement tools - existing healthcare business to consumer web and mobile products lack a value proposition and are hard to use
Need healthcare information exchange capabilities - data liquidity is increasingly important for care coordination
Need quality measurement innovations - modern EHRs must provide decision support at the point of care to ensure quality measure criteria are met

2.  ICD-10
Need Computer Assisted Coding - no clinician can remember 170,000 codes
Need Clinical Documentation Improvement - in an ICD-10 world, a clinician needs to include enough information to justify a highly granular diagnostic code
Need to seamlessly link the problem list, the documentation and the bill - surviving future audits will require a level of integration that auto-populates the problem list and suggests an appropriate billing code, all based on interpretation of what the clinician documents

3.  HIPAA Omnibus Rule
Support for enhanced security including identity management, network access control, security information and event management - these components are foundational to a mature security program
Need BYOD solutions - personal devices are here to stay.   We need to manage them centrally with minimal user impact
Need novel breach detection - inappropriate internal access can be a more significant risk than external threats

4.  Affordable Care Act
Need novel business intelligence approaches that leverages unstructured data - more than half of the typical medical record is text.   We need to be able to use it for decision support
Need prospective and retrospective reminders - turning data into information, knowledge and wisdom is the only way to achieve gains in quality, safety and efficiency
Need care management and population health - we need to achieve wellness and continuous preventative care, rather than episodic illness care

5.  Secure cloud computing resources in general
Need to sign business associate agreements - cloud solutions must include indemnification for privacy breaches
Need third party audits - we need to understand the physical and logical protections in place at cloud hosting sites
Need 99.99% reliability - the cloud has been described as "your mess, outsourced, with less reliability".   We need high reliability

To all the entrepreneurs out there - these are products and services I'll be buying over the next year.