Where Have All Our Heroes Gone?

Does it seem to you that we've lost our sense of wonder and our respect for heroes?

The press is filled with stories of flawed or fallen heroes but little praise for the tireless work done every day to make the world a better place.

In the Northeast, 2 million people lost power due to an act of God - an early winter storm.   One week later, a few thousand were still without power.   Local politicians demanded answers from power companies to explain why it took so long and why their planning for the unexpected storm was so poor.   As an infrastructure provider myself, I can tell you that utility workers have done a heroic job - deciding what work would restore power most quickly based on a Pareto analysis, doing the main/trunk/substation work rapidly and leaving the most remote parts of the grid for last.   It's been 24x7, cold, wet, and physically demanding work.    They've done their best and I respect the people that did the work.

Steve Jobs, a remarkable person,  was brilliant and charismatic but could be overly demanding, emotional, and less than perfect with his family and personal relationships.   His death was met with initial shock and an outpouring of respect.   After a week, the press turned to the dark side of Steve's personality, as nicely summarized in this New York Times article  about the short sainthood of Steve Jobs.

I'm an eternal optimist and believe that mankind is basically good.  However, I cannot help but believe that society has lost its perspective when we spend time tearing down our heroes, highlighting their mistakes, and reveling in Schadenfreude when someone falls from grace.  

Everything regresses to the mean, but wouldn't it be best to capture people at their peak of creativity and remember them for what they did right?  Of course we can learn from their mistakes and failures, but we do not need to perseverate on their nadirs when their zeniths are where they had the most impact.

As someone who lives in operational roles 24x7x365, I can say that it is very hard to achieve and maintain perfection. I've written that I do not have power or authority - what I really have is risk of failure.

I would rather celebrate success, learn from failure and acknowledge those human beings who have made a difference.  

The héroes in my life are my wife, my daughter, my parents, economist Milton Friedman, Steve Jobs, former HIT National Coordinator David Blumenthal, former Harvard Medical School Dean Joseph Martin, my second in command at BIDMC John Powers, CEO of the Massachusetts eHealth Collaborative Micky Tripathi, and the current head of CMS Don Berwick.    I'm sure each has had moments of incredible success and events they would rather forget.    They have all been inspirational to me.

So for one day, let's celebrate our heroes, flaws and all.   Let's ban all news about Lindsey Lohan and Kim Kardashian.

If we try hard enough, maybe our sense of wonder and magic will return.

The Growing Malware Problem

On Friday. I'm lecturing at Dartmouth College to the TISH workgroup (Trustworthy Information Systems for Healthcare) about the growing malware problem we're all facing.

Have you ever seen a Zombie film?   If so, you know that to stop Zombies you must shoot them in the head - the only problem is that the steady stream of Zombies never seems to end and they keep infecting others.   Just when you've eradicated every Zombie but one, the infection gets transmitted and the problem returns.   You spend your day shooting them but you never seem to make any progress.

A Zombie in computer science is a computer connected to the Internet that has been compromised by a cracker, computer virus or trojan horse and can be used to perform malicious tasks of one sort or another under remote direction.

Staring in March of 2011, the rise in malware on the internet has created millions of zombie computers.   Experts estimate that 48% of all computers on the internet are infected.   Malware is transmitted from infected photos (Heidi Klum is the most dangerous celebrity on the internet this year),  infected PDFs, infected Java files,  ActiveX controls that take advantage of Windows/Internet Explorer vulnerabilities and numerous other means.

Here's the problem - the nature of this new malware is that it is hard to detect (often hiding on hard disk boot tracks), it's hard to remove (often requiring complete reinstallation of the operating system), and anti-virus software no longer works against it.

A new virus is released on the internet every 30 seconds.   Modern viruses contain self modifying code.  The "signature" approaches used in anti-virus software to rapidly identify known viruses, does not work with this new generation of malware.

Android attacks have increased 400% in the past year.   Even the Apple App Store is not safe.

Apple OS X is not immune.  Experts estimate that some recent viruses infections are 15% Mac.

If attacks are escalating and our existing tools to prevent them do not work, what must we do?

Alas, we must limit inbound and outbound traffic to corporate networks.

BIDMC will pilot increased restrictions in a few departments to determine if it reduces the amount of malware we detect and eradicate.    I'll report on the details over the next few months.

One of these restrictions will be increased web content filtering.    I predict in a few years, that corporate networks will advance from content filtering to more restrictive "white listing".   Instead of blocking selective content categories, they will allow only those websites reputed to be safe (at that moment anyway).  I think it is likely corporate networks will block personal email, auction sites, and those social networking sites which are vectors for malware.

It's truly tragic that the internet has become such a swamp, especially at a time that we want to encourage the purchase of consumer devices such as tablets and smartphones.

I've said before that security is a cold war.   Unfortunately, starting in March, the malware authors launched an assault on us all.    We'll need to take urgent action to defend ourselves and I'll update you on our pilots to share our successful tactics.

The EHR/HIE Interoperability Workgroup

Today,  the EHR/HIE Interoperability Workgroup, originally formed by the New York eHealth Collaborative (NYeC), will announce the collaborative work of seven states (California, Colorado, Maryland, Massachusetts, New Jersey, New York, and Oregon), eight EHR vendors (Allscripts, eClinicalWorks, e-MDs, Greenway, McKesson Physician Practice Solutions, NextGen Healthcare, Sage, and Siemens Healthcare), and three HIE vendors (Axolotl, InterSystems, and Medicity.)

The objective of the EHR/HIE Interoperability Workgroup has been to define a single set of standardized, easy-to-implement interoperability specifications that will increase the adoption of EHRs and Health Information Exchange services. The effort leverages existing published standards for interoperability from the Office of the National Coordinator (ONC).

The work includes refinements to mature, well tested standards including:

*A summary of care implementation guide that further constrains the CCD/C32

*An enhanced Direct specification including SMTP/SMINE, XDR for connection to HISPs, and PKI/Certificate distribution.

The work also includes enhanced guides for those standards that the HIT Standards Committee felt required additional testing and refinement including:

*A detailed guide for implementing HPD/LDAP provider directories

*An updated guide to the components of the NwHIN Exchange specifications for "pulling" data from multiple data sources.

I offered the following quote to describe their work:

"I applaud the work that the EHR/HIE Interoperability Workgroup is doing to move states from implementation guides to production.   Their selection of Consolidated CDA and Direct is well aligned with HIT Standards Committee discussions.  The EHR/HIE Interoperability Workgroup is  also doing important work with NwHIN Exchange and Provider Directories that will provide the country with lessons learned, so that the HIT Standards Committee can recommend refinements to these emerging technologies.   I expect that the flexibility and agility of the EHR/HIE Interoperability Workgroup will serve as an ideal laboratory for standards that are rapidly evolving."

Massachusetts is rapidly implementing Direct for exchange of clinical summaries.   It's very likely that our implementation will be able to leverage the work of EHR/HIE Interoperability Workgroup for multi-state compatibility and reusability.

It's going to be a great year for HIE.

The Accountable Care Organization Final Rule

Robin Raiford has been hard at work annotating the Final ACO Rule.    Here's a version that is fully bookmarked.

She's also recommended important new resources on the CMS website:

Eligible Professionals
*Updated CMS Specification Sheets 

Eligible Hospitals
*Updated CMS Specification Sheets 

Thanks Robin!

Cool Technology of the Week

The recent power outages through the Northeast have caused everyone to think about the reliability of the electrical grid.   Throughout Massachusetts, New Hampshire, Vermont, and Maine our power lines pass from pole to pole through brilliant fall foliage.  Last week's pre-winter snow was trapped on those leaves, broke branches, and tore power lines.

Thus, the water cooler chatter is all about generators.

Although a Bloom box would be nice, the $700,000 price tag is a barrier.   Alternatives such as solar do not really work in New England winters with limited sunlight.

The next best thing is a natural gas powered generator that automatically starts and provides backup power when street power fails.  Generac is a popular model.  It's highly unlikely that natural gas will stop flowing when electricity fails.   In New England, our issue is that electricity is needed to circulate heated water, steam, or hot air, so a power failure results in a heating failure.   A generator is a necessity in places like rural New Hampshire which can be without power for weeks every year.

Here's a handy calculator to help you size your generator.

Natural gas generators that keep you powered and warm when power lines fail.  That cool! (or hot as the case may be)

The Benefits of RxNorm

I was recently asked about the benefits of RxNorm and asked my friends at the National Library of Medicine for the answers:

1.       What are the benefits of RxNorm over NDC, or SNOMED?

RxNorm represents drugs in a way that corresponds directly to a prescriber's view of a drug, as an ingredient + strength + dose form. The dose form is the form as it is actually administered (e.g. 'Injectable suspension"), not necessarily the form as it is manufactured and delivered to a pharmacy (e.g. 'Powder for suspension). The NLM has taken government and commercial sources of data, creating normalized names to produce a complete list of the drugs used in the United States. We have a very slim policy-making process, allowing us to respond quickly and effectively to tweak our model if necessary, which we have done a number of times.

The benefit of this approach is that the drugs are named consistently, the names and codes are centrally published and maintained, improvements can be incorporated quickly, and the set of drugs is complete (for the U.S.).

NDC codes represent drugs from what might be called an 'inventory' perspective. NDCs characterize and differentiate drugs on the basis of manufacturer and package size, for example. Two different NDCs could correspond to a singe RxNorm identifier; a generic drug could be made by different manufacturers or provided in different package sizes. NDCs require the use of a 'representative NDC' in order to provide a single identifier for a single clinical drug. Schemes of representative NDCs has proven to be very clumsy to use here in the US. In addition, NDCs are not centrally assigned or maintained. Each manufacturer/packager issues its own NDCs and there is no 'official list' of all NDCs in the US.

SNOMED CT is an international terminology that has a relatively complex editorial process, and requires license fees and participation in its governing organization, the International Health Terminology Standards Development Organization (IHTSDO). The SNOMED CT International Release is meant to contain the 'common denominator' of drugs across the world; each country using SNOMED CT for drugs needs to develop a National Extension separate from the International Release.

2.       What evidence is there for its use, that it has worked successfully and in which hospitals?

RxNorm has been tested by the US Centers for Medicare and Medicaid (CMS) in both a live and a 'lab' environment and found to be complete and usable. Some minor challenges noted in some details of implementation, but overall it was found extremely useful and work-able.

For a variety of reasons having to do with legacy workflows in the US, RxNorm is not currently used in e-prescribing (sending prescriptions from a prescriber to a pharmacy). However it is used in both research and in after-the-fact analysis of drug data in institutions like Stanford Hospital and  University of Florida.

3.       What is the current percentage of hospitals using RxNorm, and what has been the uptake over the last few years in the US, forecast for the next few years?

The standards environment in the US is quickly converging upon RxNorm as the designated drug vocabulary for sending electronic messages containing drug content, and I anticipate that RxNorm will be mandated for many of these uses within the US very shortly.

Thanks to the NLM for this and I look forward to continued implementation of RxNorm in my own institution.

The New Metrics for CIO Success

When I begin my career as a CIO in 1997, success was function of the basics - email delivery, network connectivity, and application functionality.    I personally wrote code, experimented with new operating systems, and created analytics using web servers, SQL, and ASP pages.

In 2011, CIO success is much more complex to measure.  

Infrastructure success can be defined as 99.99% uptime of all systems and no loss/corruption/breach of data.   The magical belief in the cloud sets expectations that IT infrastructure should be like heat, power, and light - just there as a utility whenever it is is needed in whatever amount is needed.

Application success could be defined as on time, on budget delivery of go lives according to project plans.  Two important forces make this more complex
*Consumer software stores set expectations that enterprise software should be easy - we need to fix revenue cycle workflow, isn't there an app for that?
*As the economy forces downsizing and efficiency gains, there's an expectation that workflow automation is a pre-requisite to organizational change so there is more pressure on the IT department to deliver application solutions quickly.

This all sounds impossible - deliver massive infrastructure with constant change but keep it entirely reliable and secure.   Deliver applications that support business processes in increasingly short timeframes with limited IT and business owner resources.

Thus, the modern CIO is no longer a technologist or evangelist for innovation.   The modern CIO is a customer relationship manager, a strategic communicator, and a project manager, delicately balancing project portfolios, available resources, and governance.  

Modern CIOs have little time to get infrastructure and applications right, so they must "skate where the puck will be", thinking more like CEOs about business needs and future strategies, so that critical information technology is deployed by the time it is needed.

What am I doing in FY12 to become a more effective modern CIO?

1.  I've defined key business customers (BIDMC senior management and chiefs).   I'm meeting with each one to ensure their priorities for the next year and beyond are reflected in the FY12 IT operating plan and the 5 year IT strategic plan.  Planning much more than 5 years in IT is problematic given the pace of technology change.   Working with the governance committees, I will trim this list into those projects that have the greatest impact on business strategy, quality/safety, and efficiency.

2.  I'm standardizing communication so that key customers receive monthly updates about their priority projects.

3.  I'm defining a process for managing IT projects across the enterprise that includes standardizing the IT Project Intake Process, the IT Project Life-cycle, and Project Management tools ( project documentation, project plans, and status reports).

It's my hope that by focusing on customer relationship management, communication and project management that I will create a positive working environment for the IT staff with a more limited set of well-defined projects and more engaged customers.     Doing fewer projects with greater speed and depth which meet the most critical needs of the business is much harder than agreeing to do many niche projects and moving forward slowly on all.   Given that the supply of IT resources is likely to be  fixed since healthcare budgets are under increasing pressure from healthcare reform, the modern CIO should be judged on demand management and achieving reasonable levels of customer satisfaction despite having to focus on a narrower project portfolio delivered at a faster pace.