ARRA Q&A: Are imaging costs recoupable under the HITECH act?

I got the following question from Brandon about the need to have a domain controlled network in order to comply with HIPAA.

I am currently trying to implement an EMR system in a small practice. I am trying to convince the parties involved that it is necessary to transition to a domain controlled network for security reasons even though this type of network is not required for our EMR system or its server. My understanding of HIPAA is that simply having a firewall does not qualify as a “secured network”. Am I right on this?

Brandon,
You are correct that just having a firewall does not likely qualify as a “secured network.” However, that doesn’t necessarily mean that you need to have a domain controlled network to meet the HIPAA security standards. You could still manually apply the domain security policies on to individual computers and achieve the same level of security.

Of course, the key word in that statement is the word “manually.” If you have less than 10 computers, then this probably isn’t a huge deal and can be done manually. Once you pass 10 computers (or somewhere in that range) you probably want to consider using active directory to manage the security policies on your computers. It’s much easier to apply policies on a large number of computers using active directory. Plus, you can know that the policy was applied consistently across your network.

You also shouldn’t ignore the other benefits of a domain controlled network. I’ve written previously about the benefits of things like shared drives as a nice companion to an EMR. Active Directory makes adding these shared drives trivial. It’s also a nice benefit to have a universal login that’s managed by the domain and can work on every computer in the office.

Plus, if your EMR runs on SQL Server and you buy a nice but inexpensive server with Windows Small Business Server, then you already have the software for active directory. So, it’s really an easy decision to use it. I’ve implemented it at a site with 5 computers and it’s been a great thing to have even if it’s a bit of overkill.

EMR on Twitter

I imagine that many of my readers use Twitter to find EMR information. Twitter is an interesting beast. It takes a little getting used to, but can be used in a whole number of ways. However, what people don’t realize is that you don’t have to be on Twitter and have a Twitter account to enjoy many of the benefits of Twitter.

I especially like Twitter during conferences. For example, during the HIMSS 2010 conference I would just search for the tag HIMSS2010 and found all sorts of interesting information about what was happening at HIMSS. Here’s a simple search for people talking about EMR on Twitter.

I think one of the main uses of Twitter is a way to share some of my favorite EMR links. I use this EHR and HIT twitter account to do that for some of my favorite bloggers. It’s also fun to see people’s reactions to the various items I post on that account. I guess people like what I’ve done since that account has 4232 followers of it.

At the end of the day, Twitter for me is a way for me to connect with lots of interesting people. Tomorrow, I’m going to lunch with a local CPA and blogger that I met on Twitter. It’s timely, since I’ve been looking around for a CPA. So, we’ll share lunch, I’ll teach him about blogging and we’ll see if his CPA services are a good fit for my needs.

Beyond that I’ve connected with so many people on Twitter. I’ve gotten free tickets to shows in Las Vegas. I’ve gotten free graphic design work. I’ve seen some of the latest breaking news before CNN and the likes are broadcasting it. I’ve found side work on Twitter. Plus, I’ve gotten hundreds of questions answered by my smart twitter friends.

Obviously, I’m a pretty big fan of Twitter. In fact, many of you likely found this blog through Twitter. I love Twitter because it can be used in so many ways. How do you use Twitter?

Also, if you want to connect to my personal twitter account (which also does quite a bit of EMR related content), I’m @techguy.

EMR Stimulus Q&A: Government Incentives for EMR Adoption Outside of Medicare and Medicaid

Time again for everyone’s favorite topic (or so it seems), EHR stimulus questions and answers. Today’s EMR stimulus question comes from Jamie who asked the following question on a previous post:

Does anyone know whether or not the government is implementing some kind of incentive benefit for non-Medicare/Medicaid users? Or are these practices totally out of luck?

The short answer (at least for now) is not really. The ARRA EHR stimulus money is provided through Medicare and Medicaid programs as “bonuses” for those who show “meaningful use” of a “certified EHR.”

With that said, there are some grants available for special situations. For example, they have a beacon communities program which are given to organizations that will supposedly take EHR software to the next level and be examples for their communities of what can be done with IT and EMR software.

I’ve heard there’s other grants that people can apply for also, but I’m not sure all of the details. I also hear that there might be some EMR stimulus money available in the latest healthcare reform bill. For example, I read somewhere recently that the healthcare reform bill includes some stimulus money for long term care which has basically been left out of stimulus money as well.

Clinics interested in EMR software should also be able to get some help from the RECs and HITRCs. At least their stated mission is to assist doctors to adopt and meaningfully use EMR software. I think the jury’s still out on how helpful these RECs will actually be. It’s a nice idea, but could go horribly wrong if not done right.

I won’t go into all the details here, but not qualifying for the EMR stimulus money might just be the best thing that’s happened to your practice. That means you won’t be distracted and you don’t need to wait. You can hone in on the other EMR benefits and start reaping those benefits without all the bureaucracy.

Offsite Backup Services for an EMR

I’ve been seeing a number of new offsite backup services for EMR software. They are becoming quite sophisticated and are an option that I think many doctors offices should consider. I know that in one doctors office I setup a USB hard drive which they could take home with them in order to have some semblance of an off site backup.

This is far from perfect and even harder to secure the right way. Not something that most doctors offices will want to take on alone. However, the real problem with this type of “off site” backup is that they too often forget to take the backup offsite. They don’t verify that the backup was done. I’m sure there’s more, but you get the picture.

Seems like many of these off site backup services provide a really great service that solves a lot of these problems. Not all of them (like verifying that the backup can be restored), but they are becoming quite sophisticated.

I’m interested to hear other people’s experiences with these type of offsite backup services. What do you like? What do you dislike? What do you wish they’d do?

I have a feeling these type of really useful services won’t be in rich supply on the HIMSS vendor floor, but I’ll be keeping my eyes out for useful and practical services like this at HIMSS. If you’re a vendor of a service like this that will be at HIMSS, let me know so we can meet. Same goes for any ambulatory EMR vendors. I’d love to meet with you at HIMSS too.

Large EMR Vendor Bias Towards EMR Stimulus

One thing I’m starting to notice is that it seems that ALL of the large EMR vendors are strong proponents of the EMR stimulus. All but a couple of the comments I’ve found from large EMR vendors laud praise upon the HITECH act. Listening to the information they’re putting out, you’d think that this was a fantastic stimulus package that will just be too good to pass up.

Now, I’m not saying that what these EMR vendors are saying is a lie (although some of the things they’ve said are). What I am saying is take a look at what motivation an EMR vendor has to do anything but prop up the EMR stimulus package. As far as I can see, there’s little benefit to their EMR business to talk poorly about the EMR stimulus. EMR vendors want people to think that the EMR stimulus is simple, effective and incredibly well done. If this were the case, many doctors should and would be all over it and EMR vendors would see increased sales. If EMR vendors were to describe it as complicated, ineffective and poorly defined, then that means fewer sales for those EMR vendors.

My point here isn’t to argue whether the EMR stimulus is good or not. It’s just to highlight that EMR vendors are (and probably should be) biased in their opinions of the EMR stimulus package.

Interestingly, a few smaller EMR vendors have made the opposite case. They’ve come out that the EMR stimulus is an atrocity, does little to improve doctors’ productivity and often hurts productivity.

The battle lines have been drawn. Just make sure you’re not a casualty of biased information.

EMR and HIPAA 2009

I knew that this year had been a really great year on EMR and HIPAA. However, I didn’t really realize how much we’d exploded until I started looking at the stats for the site. Thanks to the EMR stimulus (among other things), EMR and HIPAA saw an 800% increase in traffic in 2009 as compared to 2008. That amounts to the following stats for the year:
1.57+ million pageviews
900,00+ visits to EMR and HIPAA
Average Time on Site: 3 minutes and 17 seconds
Biggest Single Day: 8,679 pageviews

I’m most proud of how long people stay on the site to read what’s been written. However, I can’t really get my head around 1.5 million pageviews either. Isn’t technology amazing?

In 2009, I wrote 386 Articles on EMR and HIPAA. That’s a little over 1 post per day. I really didn’t think I posted that many. I guess they start to add up over time. However, even more exciting for me is that there have been over 2325 comments made on EMR and HIPAA. I love to see that much engagement and have loved so many of the conversations we’ve had. I’ve been educated and informed as much or more than I’ve helped you.

Google was by far my largest source of traffic with the following search terms being the most popular: EMR companies, EMR Stimulus, EMR vendors, “health it resource center” arra, ehr vendors. However, I’ve also seen a huge increase in traffic from my techguy and EHR and HIT twitter accounts. I’m amazed at how many people are discussing EMR on Twitter. It’s an amazing tool.

Of course, I also want to thank all of those companies that have sponsored EMR and HIPAA this year: Medscribbler, InterSystems,MxSecure, EMR Consultant, EHR Scope, Medical Voice Products, Plextra, MD-IT, Sfax, NextGen, My EMR Choice, EMR Jobs, andDigiDMS. Their sponsorship of EMR and HIPAA really does make a huge difference. It seems like it’s been mutually beneficial since almost all of the above advertisers have renewed their ad on EMR and HIPAA (and many of them multiple times). I have a feeling that 2010 will be an even bigger year for EMR advertising.

EMR and HIPAA has a lot of things in the works for 2010. I’ll follow up this post with a post talking about some of our plans for 2010. It’s going to be an exciting year.

ONC Blog – Federal Advisory Committee – Judy Sparrow

All I can say is that it’s very cool that ONC now has a blog. This is probably right up there with when I found past HHS secretary Mike Leavitt’s blog. Ok, yes I am a complete blog nerd. At least I’m able to admit it up front.

Basically, Judy Sparrow has just done an introduction post where she talks about the Federal Advisory Committees and their role at ONC. She’s the ONC liason for these committees and so hopefully she’ll keep us updated on progress with these two very important committees. She also provides this explanation about the committees in her first ONC blog post:

“FACAs” get their name from the Federal Advisory Committee Act, which lays out the guidelines for such committees. FACAs are advisory and intended to provide external guidance to the government. Typically members of the group are not federal employees. They are also very open committees – meetings are held in public, information on the meetings is posted in the Federal Register, and all FACA records are readily available. At the very root of the FACA mandate is transparency and collaboration.

ONC has two FACAs – the HIT Policy Committee and the HIT Standards Committee. These committees were established to obtain outside advice or recommendations on key health information technology topics from leaders who represent various stakeholder groups.

I think we generally knew this, but it was nice to have a bit more background. This would have been really useful 6 or so months ago when these committees were a new thing (at least for me).

I hope that Judy is able to keep the blog up to date and that it won’t just turn into an announcement site. I hope Judy will provide real content about the process, timelines and perspectives of ONC. If she does that, then it will be really interesting and a great part of the EMR conversation which is already happening on blogs like this one.