Exploring Vermont

Last Friday, I lectured at Dartmouth about the increasing challenges of information security in a world filled with malware.

After spending a few hours with the Dartmouth TISH group, my wife and I drove to Burlington, Vermont for a weekend of exploration.   It's always been our retirement plan to run a small family farm, raising organic vegetables and a few animals that contribute to the ecosystem ie. chickens for insect control/fertilizer, pigs for consumption of food scraps, and goats for trimming grass/plant overgrowth.    Vermont has the rolling hills, fertile farmland, and agricultural zoning we desire but also has close proximity to arts, culture, and great small businesses.

On our first night, we ate at our favorite Vermont vegan friendly restaurant, A Single Pebble  in Burlington and stayed at the Willard Street Inn, in a cozy 3rd floor nook.

On Saturday morning, we explored Burlington, South Burlington, Williston, and Shelburne.  We walked the grounds of Shelburne Farm (pictured above), then enjoyed a loaf of fresh broad, local mustard, apple cider, and fruit while sitting on the shore of Lake Champlain.    We spent the afternoon exploring Charlotte and Hinesburg, cities south of Burlington with extensive farming.    For dinner, we enjoyed a vegan spicy corn and black bean pudding at the Bearded Frog and stayed the night at The Elliot House.

On Sunday we drove the covered bridges and back roads of Charlotte and Hinesburg, then explored central and southern Vermont, driving to Bristol (near Middlebury), Lincoln, and Warren/Sugarbush.      Road closures due to Hurricane Irene rerouted us through Killington and Woodstock, then to White River Junction and the drive home to Boston.

My conclusion - Vermont is a remarkable place with warm people, strong locavore/small business support , and the perfect combination of wide open spaces with access to high tech services.

Our quest for farmland begins.

The November HIT Standards Committee

Today, the HIT Standards Committee shifted gears from the Summer Camp work on Meaningful Use Stage 2 and began new interoperability efforts.

We began the meeting with a presentation by Liz Johnson and Judy Murphy about the Implementation Workgroup's recommendations to improve the certification and testing process.   These 15 items incorporate the Stage 1 experience gathered from numerous hospitals and eligible professionals.   If ONC and NIST can implement this plan, many stakeholders will benefit.  The Committee approved these recommendations without revision.

Next, we focused on content, vocabulary and transport standards.

In my October HIT Standards Committee blog post, I noted that HITSC should work on the following projects:

Content
*Continued refinement of the Consolidated CDA implementation guides and tools to enhance semantic interoperability including consistent use of business names in "Green" over-the-wire standards.
*Simplifying the specification for quality measures to enhance consistency of implementation.
*Standardizing DICOM image objects for image sharing and investigating other possible approaches.   We'll review image transfer standards, image viewing standards, and image reporting standards.
*Query Health - distributed queries that send questions to data instead of requiring consolidation of the data

Vocabulary
*Extending the quality measurement vocabularies to clinical summaries
*Finalizing a standardized lab ordering compendium

Transport
*Specifying how the metadata ANPRM be integrated into health exchange architectures
*Supporting additional NwHIN standards development (hearings about Exchange specification complexity, review/oversight of the S&I Framework projects on simplification of Exchange specifications).   Further defining secure RESTful transport standards.
*Accelerating provider directory pilots (Microdata, RESTful query/response that separates the transaction layer from the schema) and rapidly disseminating lessons learned.

The November Committee agenda included a discussion of  Consolidated CDA, Quality Measures, and NwHIN Implementation Guides.

Doug Fridsma began with a discussion of the Consolidated CDA work and the tools which support it.

The Committee had a remarkable dialog with more passion and unanimity than at any recent discussion.   We concluded:
*Simple XML that is easily implemented will accelerate adoption
*That simple XML should be backed by a robust information model.   However, implementers should not need expert knowledge of that model.  The information model can serve as a reference for SDOs to guide their work
*Detailed Clinical Models, as exemplified by Stan Huff's Clinical Information Modeling Initiative (CIMI) hold great promise.   Stan has assembled an international consensus group including those who work on
 -Archetype Object Model/ADL 1.5 openEHR
 -CEN/ISO 13606 AOM ADL 1.4
 -UML 2.x + OCL + healthcare extensions
 -OWL 2.0 + healthcare profiles and extensions
 -MIF 2 + tools HL7 RIM – static model designer

Their work may be much more intuitive than today's HL7 RIM as the basis for future clinical exchange standards.

*Rather than debate whether Consolidated CDA OR GreenCDA(simplified XML tagging) should be the over the wire format, the Committee noted that "OR" really implies "AND" for vendors and increases implementation burden.   The Committee endorsed moving forward with GreenCDA as the single over the wire format.  
*We should move forward now with this work, realizing that it will take 9-12 months and likely will not be included in Meaningful Use Stage 2, but it is the right thing to do.

Thus, the future Transfer of Care Summary will be assembled  from a simple set of clinically relevant GreenCDA templates, based on CIMI models, as needed to support various use cases.  There will be no optionality  - just a single way to express medical concepts in specific templates.

To support this approach, we'll need great modeling tools.    David Carlson and John Timm presented the applications developed to support the VA's Model Driven Health Tools initiative.  This software turns clinical models into XML and conformance testing tools.   The committee was very impressed.

Next, Avinash Shanbhag presented the ONC work on Quality Measures  that seeks to ensure quality  numerators and denominators are expressed in terms of existing EHR data elements captured as part of standard patient care workflows.

Avinash also presented an update on transport efforts, which include easy to use, well documented implementation guides for SMTP/SMIME and SOAP.   The work is highly modular and does not require that the full suite of NwHIN Exchange specifications be implemented for SOAP exchanges.

As part of the ongoing efforts to improve NwHIN Exchange, the HIT Standards Committee is seeking input from NwHIN implementers per this blog post.

Finally, Wil Yu updated the committee on the SHARP and other innovation programs.

There will be a great body of challenging work to do in 2012.   What's needed after that?  The next 5 years will include many new regulations as healthcare reform is rolled out.   It's clear that the Standards Committee will have many topics to discuss.

Massachusetts State HIE Update

Yesterday, Rick Shoup, Manu Tandon and I presented the updated Massachusetts Stategic/Operating Plan, State Medicaid Health Plan/Medicaid Management Information System plan, and the Implementation Advance Planning Documents for Health Information Exchange to the HIT Council and the HIT/HIE Advisory Committee.   The budgets and strategy were approved by the Council.

Here's the overview of the strategy.

It's based on 3 principles

*Leveraging the components needed by the State Medicaid Health Plan/Medicaid Management Information System for use by all public/private Health Information Exchange Stakeholders
*Building upon existing private sector investment
*Connecting the "last mile" of every payer, provider and patient to the state HIE backbone.

What do we mean by "last mile"?

There are roughly 20,000 licensed practicing physicians in Massachusetts and of those approximately 10,000 are currently or will be active users of EHRs and a Health Information Exchange (HIE). Some hospital and ambulatory applications are already connected to local or regional health information exchanges (HIEs) such as the New England Healthcare Exchange Network (NEHEN), SafeHealth, the North Berkshire eHealth Collaborative HIE, the Community Hospital and Physicians Practice System’s (CHAPS) HIE, the UMass HIE and Wellport HIE. However, many small providers have no HIE connectivity or use a web portal approach which is not integrated into their EHR workflows.

In order to optimize the transport capabilities of the state HIE, all hospital information systems and EHRs need to be connected to the transport backbone. The end result will be an integrated network of networks that enables any payer, provider, patient or consumer to exchange data. We refer to this as the “last mile.”  

The “last mile” will be implemented as follows:

First, a better understanding of the scope must be gained.   MeHI, the State Designated Entity and Regional Extension Center for Massachusetts, will do an analysis of Hospital Information System and EHR adoption in Massachusetts to identify those providers, institutions and applications which are not yet connected to an HIE.

 Second, further analysis will identify the additional software or services required to enable HIE connectivity such as  sending and receiving clinical summaries and HL7 lab/public health messages from Hospital Information Systems and EHRs to the HIE backbone.  Massachusetts wants to move quickly to implement this connectivity before it is required by future stages of  Meaningful Use.

Third, is the delivery of system integration services to connect to the HIE based on the prior analysis. These services will include the resources necessary to install and configure software, provide training and education or other support activities to practices throughout the Commonwealth.

Some types of providers were not included in the original scope of meaningful use incentives or have been slow to adopt for other financial reasons.  These include the Behavioral Health and Long Term Care communities and some solo and two clinician practices.   Last mile connectivity for these late adopters may include web-based applications that are easy to use and support.  These applications will generate and receive electronic data that is being developed as part of the Commonwealth's IMPACT Challenge Grant. Thus the Massachusetts HIE approach includes those without EHRs and those with EHRs but lacking the capabilities to send and receive data directly.

Fourth, a single project management office will manage support of the project.  MeHI, as that project management office and in collaboration with EOHHS, will centralize last mile integration expertise and achieve economies of scale by creating an efficient approach to last mile integration.

Fifth, MeHI will provide educational materials and training so that clinicians are aware how to optimize their new HIE connectivity, achieving meaningful use stage 2 and maximizing the amount of data flowing to other clinicians, public health, and quality registries.

Hospital information system and electronic health record vendors report that State HIEs tend to build central infrastructure while assuming the endpoints will be able to connect to the HIE on their own.  However, most practices lack the technical capability and incentives to do this work, so the value of the HIE is not realized and sustainability is never achieved.  Massachusetts intends to avoid this failed scenario by actively ensuring the connection of the last mile.

With stakeholders aligned and the strategy approved, Massachsetts is ready to accelerate its HIE efforts.

Nutrition Planning Resources on the Web

I was recently asked the question:

"BIDMC does not have any sample menus to give to patients – either for weight loss or for healthy eating in general. Our nutritional counseling still consists of meeting with a nutritionist and being advised regarding “good” vs. “bad” foods, getting some instruction on calculating calorie content and some advice how to turn a list of foods into a meal.

I’ve checked around on the internet and there are some commercially available programs that will generate menus, based on the kind of diet that one wants but they seem to have substantial constraints in terms of items that are included and how easy it is to exclude things.
 
What I’m a interested in finding out is the possibility of creating an EHR interface that would allow either a patient or a physician to generate not a diet, but a two week menu  which would be customized to dietary preferences and a set of calories.

So for example if I have a patient that needs to lose 30 pounds, doesn’t eat breakfast, is a pescatarian and would like to consume 1/3 of their calories at lunch and the rest at dinner, is there a way of doing that?"

Margo Coletti, our Director of Knowledge Services (formerly the Medical Libraries) researched the question and wrote the following answer

"There is no database currently that produces menus with that much specificity.  However, Nutrihand Pro comes very close.

BIDMC subscribes to the Nutrition Care Manual which is available through our Intranet Portal.  The Client Education tab at the top lists several menus for weight loss and for various health conditions and dietary restrictions (MI, tyramine-restricted, diabetic, etc)

The Joslin Clinic has excellent nutritionists for you to refer your diabetic or prediabetic patients to. These nutritionists will work with the patient to tailor menus to their needs.

Joslin also has an excellent weight loss program for diabetics.  The nutritionists, again, will work with patients to tailor their menus.

There are also several databases that produce nutrition facts for a given food or food product. Here are some that the Joslin Clinic uses in their nutrition education:
http://www.calorieking.com/ (One can download a free CalorieKing-Joslin Food Awareness Toolbar to count carbs)
http://caloriecount.about.com/ (Nutrition information with a recipe analysis feature)
http://calorielab.com/ (Information on calorie content of foods and caloric expenditure of activities)
http://www.dietfacts.com/ (Nutrition information website that includes many restaurants)
http://www.eatright.org/ (Website for the American Dietetic Assn)
http://nal.usda.gov/fnic/foodcomp/search/ (Nutrient Data Laboratory; provides extensive nutrition information and values for potassium, sodium, protein)

I hope this is helpful."

Per their website, Nutrihand is free when you join with your nutritionist or dietitian.  If you're getting professional help offline, it enables you and your counselor to work together online on meal plans, shopping lists, and fitness goals. You can print out reports to bring to your sessions. Diabetics who use insulin pumps can upload data from their glucometer on a private and secure network and chart or graph glucose levels, blood pressure , and other personal data to adjust pump settings and track health status.

We'll study these resources and incorporate the most useful ones into our patient and provider portals.

Cool Technology of the Week

In a HIPAA and HITECH compliant environment, I have to carefully watch where and how data is stored.

Unfortunately, there are many stakeholders and collaborators who want to use Dropbox, which lacks the necessary privacy protections.

What we really need is Dropbox for the private cloud that enables similar functionality on our HIPAA compliant enterprise storage.

We're evaluating 4 alternatives

1) Dropbox Teams - Encrypted enterprise Dropbox
2) Oxygen Cloud  -  Supports EMC Atmos Cloud Oriented Storage (used at BIDMC for image archiving)
3) Blackboard Learn - Formerly Xythos
4) ShareFile - Recently acquired by Citrix

HIPAA compliant Dropbox-like functionality.   That's cool!  I'll let you know what we decide.

Where Have All Our Heroes Gone?

Does it seem to you that we've lost our sense of wonder and our respect for heroes?

The press is filled with stories of flawed or fallen heroes but little praise for the tireless work done every day to make the world a better place.

In the Northeast, 2 million people lost power due to an act of God - an early winter storm.   One week later, a few thousand were still without power.   Local politicians demanded answers from power companies to explain why it took so long and why their planning for the unexpected storm was so poor.   As an infrastructure provider myself, I can tell you that utility workers have done a heroic job - deciding what work would restore power most quickly based on a Pareto analysis, doing the main/trunk/substation work rapidly and leaving the most remote parts of the grid for last.   It's been 24x7, cold, wet, and physically demanding work.    They've done their best and I respect the people that did the work.

Steve Jobs, a remarkable person,  was brilliant and charismatic but could be overly demanding, emotional, and less than perfect with his family and personal relationships.   His death was met with initial shock and an outpouring of respect.   After a week, the press turned to the dark side of Steve's personality, as nicely summarized in this New York Times article  about the short sainthood of Steve Jobs.

I'm an eternal optimist and believe that mankind is basically good.  However, I cannot help but believe that society has lost its perspective when we spend time tearing down our heroes, highlighting their mistakes, and reveling in Schadenfreude when someone falls from grace.  

Everything regresses to the mean, but wouldn't it be best to capture people at their peak of creativity and remember them for what they did right?  Of course we can learn from their mistakes and failures, but we do not need to perseverate on their nadirs when their zeniths are where they had the most impact.

As someone who lives in operational roles 24x7x365, I can say that it is very hard to achieve and maintain perfection. I've written that I do not have power or authority - what I really have is risk of failure.

I would rather celebrate success, learn from failure and acknowledge those human beings who have made a difference.  

The héroes in my life are my wife, my daughter, my parents, economist Milton Friedman, Steve Jobs, former HIT National Coordinator David Blumenthal, former Harvard Medical School Dean Joseph Martin, my second in command at BIDMC John Powers, CEO of the Massachusetts eHealth Collaborative Micky Tripathi, and the current head of CMS Don Berwick.    I'm sure each has had moments of incredible success and events they would rather forget.    They have all been inspirational to me.

So for one day, let's celebrate our heroes, flaws and all.   Let's ban all news about Lindsey Lohan and Kim Kardashian.

If we try hard enough, maybe our sense of wonder and magic will return.

The Growing Malware Problem

On Friday. I'm lecturing at Dartmouth College to the TISH workgroup (Trustworthy Information Systems for Healthcare) about the growing malware problem we're all facing.

Have you ever seen a Zombie film?   If so, you know that to stop Zombies you must shoot them in the head - the only problem is that the steady stream of Zombies never seems to end and they keep infecting others.   Just when you've eradicated every Zombie but one, the infection gets transmitted and the problem returns.   You spend your day shooting them but you never seem to make any progress.

A Zombie in computer science is a computer connected to the Internet that has been compromised by a cracker, computer virus or trojan horse and can be used to perform malicious tasks of one sort or another under remote direction.

Staring in March of 2011, the rise in malware on the internet has created millions of zombie computers.   Experts estimate that 48% of all computers on the internet are infected.   Malware is transmitted from infected photos (Heidi Klum is the most dangerous celebrity on the internet this year),  infected PDFs, infected Java files,  ActiveX controls that take advantage of Windows/Internet Explorer vulnerabilities and numerous other means.

Here's the problem - the nature of this new malware is that it is hard to detect (often hiding on hard disk boot tracks), it's hard to remove (often requiring complete reinstallation of the operating system), and anti-virus software no longer works against it.

A new virus is released on the internet every 30 seconds.   Modern viruses contain self modifying code.  The "signature" approaches used in anti-virus software to rapidly identify known viruses, does not work with this new generation of malware.

Android attacks have increased 400% in the past year.   Even the Apple App Store is not safe.

Apple OS X is not immune.  Experts estimate that some recent viruses infections are 15% Mac.

If attacks are escalating and our existing tools to prevent them do not work, what must we do?

Alas, we must limit inbound and outbound traffic to corporate networks.

BIDMC will pilot increased restrictions in a few departments to determine if it reduces the amount of malware we detect and eradicate.    I'll report on the details over the next few months.

One of these restrictions will be increased web content filtering.    I predict in a few years, that corporate networks will advance from content filtering to more restrictive "white listing".   Instead of blocking selective content categories, they will allow only those websites reputed to be safe (at that moment anyway).  I think it is likely corporate networks will block personal email, auction sites, and those social networking sites which are vectors for malware.

It's truly tragic that the internet has become such a swamp, especially at a time that we want to encourage the purchase of consumer devices such as tablets and smartphones.

I've said before that security is a cold war.   Unfortunately, starting in March, the malware authors launched an assault on us all.    We'll need to take urgent action to defend ourselves and I'll update you on our pilots to share our successful tactics.