The organization has been instrumental in advancing healthcare innovation and technology strategies, including EHR adoption and health equity.
An organization well-known for advancing healthcare innovation is shutting down after more than two decades.
Executives for Health Innovation (EHI), which launched in Washington DC in 2001 as the eHealth Initiative, is ending its run and will distribute its resources to other non-profits. Executives say the organization, created to promote the adoption of health technology, was responsible for gathering thousands of health and technology executives, advocating for federal incentives, providing grant funding to communities, and conducting meaningful research.
“Over the past 20 years, EHI has brought together stakeholders from across the health sector to share diverse perspectives, advance innovations to improve population health and build meaningful collaborations that are transforming healthcare delivery,” Amy McDonough, chair of the board of directors and managing director of Google's Fitbit division, said in a press release. “I’m so proud of what this community has achieved. While the work is not done, we are confident in the power of the partnerships we've built to sustain and carry our mission forward.”
“Healthcare connects a variety of players who don’t always like to play in the sandbox together,” added Jennifer Covich Bordenick, EHI's chief executive officer. “We helped people recognize that collaboration improves the experience for both patients and providers.”
She noted that when EHI formed, prescriptions were typically written out on paper, less than one in five providers was using electronic health records and telehealth " was something you saw in movies." Some 20 years later, roughly 94% of all prescriptions are electronic, EHR adoption is nearing 90%, and virtual care has become a standard of care.
The announcement drew comments of praise from several healthcare organizations and executives, including Micky Tripathi, the Health and Human Services Department's National Coordinator for Health Information technology.
“EHI's unique strength lies in its ability to bring together multi-stakeholders and competitors in health and technology, fostering a spirit of collaboration," he said in the press release. "This collaborative approach was instrumental in driving innovation, breaking down barriers, and accelerating progress in health technology. Their legacy is a group of collaborative leaders who will boldly propel us into the future.”
“EHI inspired and shaped healthcare by sharing real stories of how organizations can harness the power of technology for the betterment of patient care and well-being," added Roy Schoenberg, chief executive officer of telehealth company Amwell. “The true legacy of EHI is embodied in the countless individuals who participated in our mission, carrying forward the torch of innovation and driving positive change in healthcare.”
Matthew Brigger, the hospital's chief of otolaryngology, says collaboration is the key to better clinical outcomes and more involved providers.
Innovation in healthcare doesn’t always have to involve technology. It can focus on new ideas or strategies that shake up the status quo and create different—and better—pathways to delivering or managing care.
At Rady Children's Hospital in San Diego, Matthew Brigger, MD, MPH, is working to change how the hospital treats its young patients, many of whom come to the hospital for complex care or a variety of care concerns. As a result, they see several clinicians, usually separately and sometimes in several locations, a process that can be stressful to both the patients and their families.
Brigger, the hospital's chief of the division of otolaryngology, figures these young patients, their family members—and, just as importantly, their care providers—could benefit from a connected care platform that focuses on collaboration.
"There's just so much overlap," he says. "But how can you operationalize when that overlap occurs?"
Matthew Brigger, MD, MPH, chief of the division of otolaryngology at Rady Children's Hospital. Photo courtesy Rady Children's Hospital.
Brigger notes that each member of the care team has specific responsibilities and care concerns, yet everyone is focused on care for the patient. A specialist focused on just the heart or kidneys or bones will affect and will see the effects of care delivered by other specialists, sometimes without even realizing the influences. So it stands to reason that all the providers caring for a specific patient should get together and collaborate.
"We specifically get together in a room," he says.
That's not as easy as it sounds. Specialists are specialists for a reason, and their focus is often laser-trained on that particular area of expertise. The idea of working with others and participating in group discussions over whole-person care might not sit too well with them.
"There is a little convincing that has to go on," Brigger admits. "But this is how we're going to re-think collaborative care. We're all really doing a lot of the same things, but in different ways. If we can sit down and have that discussion, we'll see these ideas develop."
"It's really about presenting a vision," he adds, describing how he approached hospital leadership with his ideas. "We're showing how we can streamline and improve care for medically complex children … by working together and looking at the whole child."
Brigger says technology does play a part in this care management routine, by allowing providers in other locations to join conversations and meetings virtually and share data. They can also share advice on using new technologies such as AR and VR glasses and wearables.
"We're all learning and trying to understand how to do things," he says. "Having a C-Suite that recognizes the value of innovation is great. And by working together, I might see something that another specialist doesn't see. Everyone learns from everyone."
"We also challenge each other," Brigger adds. "We'll start with a presentation. This is the box. It's our job to think outside the box."
Patients and their families also play an important role in this process. New care plans won’t work out if the patient isn't on board. And with children, there's an added emphasis to creating care plans that meet the needs of the entire family.
"The parents are often easiest to convince and the most receptive to new ideas and innovation," Brigger says. "They're frustrated [by what their child has gone through] and motivated to look for ways to make healthcare better. They are a driving force. They've helped us to design so many programs."
That's especially important in pediatric care, he says, as many new and intriguing technologies and ideas aren't designed with children in mind. Many a children's hospital executive has had to take technology designed for an adult patient and modify it for pediatric care.
"It's often incumbent upon us to build these things out," he says. "And that’s where having parents and other [care team members] is really valuable."
That strategy also pertains to gaining payer support for what is often very expensive healthcare. Brigger says that while most revenue cycle strategies are left to management, care providers and parents do help that process by developing anecdotal information on how innovation is changing outcomes for children.
"Even if it is one child at a time, it's important to see what we can do with the technology," he says. "That's a heartstring we definitely feel."
Brigger's team-based approach to care has turned Rady Children's Hospital into a resource for other health systems across the country. Aside from sending their most complex patients to Rady, they also ask for advice on how to improve care coordination and management. With that in mind, hospital leadership is putting together the infrastructure needed to develop Rady as a center of excellence.
"There's a lot more to do," he says. For example, he'd like to breach the invisible walls that so often separate in-patient and out-patient care, creating care pathways that use technology and new ideas to connect patients and providers before, during, and after hospital stays.
"There are a lot of opportunities that we should be exploring," he says. And many of them are coming out of collaboration.
"Wow, it really works." Dr. Arif Kidwai, president at St. Johns Radiology Associates, chats with revenue cycle editor Amanda Norris about the gaps the organization was seeing and the voice recognition technology it implemented to fill those gaps.
In an effort to address social drivers of health that hinder healthcare access, the North Carolina-based health system is locating a virtual care clinic within a Charlotte-based apartment complex.
Atrium Health is expanding its telehealth platform with a virtual care clinic located within an apartment complex.
The 40-hospital, North Carolina-based health system has announced a partnership with Ascent Housing that will locate the clinic in Charlotte's Peppertree Apartments. The clinic, featuring virtual care services and an on-site healthcare technician to assist with appointments, will offer primary and specialty care services for complex residents as well as non-residents.
The announcement is the latest in a wide variety of programs launched across the country to address social drivers of health, or non-clinical factors that affect clinical outcomes. They include family life, housing, transportation, income and employment, ethnic and community influences, education and digital literacy.
In some communities, health systems are partnering with community organizations to include healthcare services in planned housing complexes, alongside markets and food banks, libraries schools and other services.
“At Atrium Health, we believe that it’s essential for people to have safe, sustainable and affordable housing, not only because it is integral to overall health and well-being, but because everyone deserves a secure space to call home,” Kinneil Coltman, executive vice president and chief community and social impact officer for Advocate Health, part of the Atrium Health network, said in a press release. “We also believe that healthcare is a fundamental right to which everyone should have access, regardless of their background, income or where they live."
"The opening of this virtual primary care location at Peppertree represents the first time Atrium Health has established a virtual care location directly in a housing community," she added. "With this virtual care location, we are taking a step toward closing the gap in healthcare access and making it easier for our patients to get the care they need and deserve.”
The clinic will include a telemedicine platform with digital health tools, including a connected otoscope, stethoscope, and high-resolution camera for comprehensive examinations overseen by providers at Atrium Health. It will also offer on-site testing for such concerns as COVID-19, the flu, strep throat and some infections.
The clinic will be open on weekdays, while after-hours and weekend services can be accessed through the health system's website and mobile health app.
The health system has launched a number of programs over the last few years to expand care into the community, including the Meaningful Medicine program, which was unveiled in 2022 to provide services to the Charlotte-Mecklenburg School District, Central Piedmont Community College and several YMCA sites.
Earlier this year, the health system announced a partnership with Best Buy to enhance its remote patient partnering platform, with technology and care management services overseen by Current Health, a Best Buy company.
Artificial intelligence should be used to support, not supplant, the healthcare provider.
Editor's Note: Jeremy VanderKnyff, PhD, is the chief integration and informatics officer for Proactive MD, a South Carolina-based advanced primary care provider.
Artificial intelligence (AI) and emerging chatbot technologies are revolutionizing the way healthcare is being delivered. Designed to mimic human intelligence to improve upon and perform standard operational tasks, AI is used by numerous healthcare organizations worldwide, with new products entering the marketplace daily.
Integrating AI in healthcare has a number of advantages, including accelerating the discovery of insights, making instantaneous clinical decisions, minimizing a provider’s time spent on administrative tasks, and supporting training and education—all of which have the potential to generate optimal health outcomes for patients.
With such cutting-edge advancements emerging at a rapid rate, there’s often an unidentified and wholly unexplored type of risk involved. The almost daily introduction of new healthcare AI capabilities significantly outpaces our ability to measure and diligently analyze its accuracy and performance. It’s crucial to try and identify the shortcomings of AI in healthcare in order to best use its advantages, and that means we have to ask: what are providers willing to sacrifice, and what do patients lose?
Considering the Unconscious Biases of Artificial Intelligence in Healthcare
There are few facets of healthcare that are unaffected by the unconscious biases of AI, including risk identification, healthcare claims, and data security. Research has found that some algorithms with these technologies have severely underestimated the risk for patients. This flaw exacerbates the already adverse problem that underserved populations face: underdiagnosis. Historically in healthcare, this disproportionately affects people of color, playing out in the form of back pain in black women and prostate cancer in black men.
Many healthcare organizations implement AI technologies to help identify patients who may need closer management during care; however, because these tools have now been trained on fundamentally flawed datasets, they often underestimate patient risks. As this overwhelmingly impacts people of color, it furthers the impediments to proper care that already afflict underserved populations.
Additionally, one lurking variable to consider is how access to care further skews the dataset AI references. For example, a significant portion of the population lacks proper access to healthcare, thus creating fewer claims. To an 'uninformed' AI model, these individuals would present as healthy—which could be far from the truth. In fact, research tends to point to lack of care access leads to poorer health outcomes over time.
The Threats of Artificial Intelligence Technologies on Patients
Innovative technology, like a chatbot, creates an ability to simulate a human interaction. It can joke with you, educate you, and give you advice like another human would.
However, as the use of chatbot technology in healthcare increases, the personal touch and impact that a provider can make on patients and their health begins to be sacrificed in the name of advancement. Removing the personal element from healthcare interactions entirely is a costly thing to make outdated, and it’s a choice that will continue to reveal negative repercussions the more it’s implemented.
We are seeing a surge in healthcare companies rebranding as 'technology companies,' despite the fact that healthcare is fundamentally human-centric. Healthcare is one of the most sensitive, personal, and important things in our lives, and it’s crucial for us to consider the impact that these tools will have on patients.
It’s easy to take our own health access and health literacy for granted; we make appointments, we understand diagnoses, and if we don’t know what a certain diagnosis means, we have the tools to ask those meaningful follow-up questions. Artificial intelligence is a convenient tool for the healthcare-informed.
For underserved, underrepresented populations, however, artificial intelligence is a health barrier at best and a severe health risk at worst. As healthcare leaders, how much are we willing to make human-centered healthcare 'a thing of the past' in order to incorporate new AI technologies?
Artificial Intelligence Tools as Decision Support, Not Decision Makers
The foundation of our problem reveals itself because we are asking the question, 'How do we bypass the human altogether?' We should be asking 'How do we find the right balance?' There has to be a middle ground where the best of human-touch and advanced technologies thrive.
No human is infallible. That is certainly unmistakable when we realize that our own shortcomings shape and ultimately 'flaw' the systems of AI we create. As the healthcare landscape continues to change rapidly, we should look at AI tools as clinical decision support tools, rather than decision makers. Artificial intelligence technology is meant to be an extension of the human provider to augment decisions, not to replace them outright.
Nothing can replace the compassionate care of a provider. They can see you, hear your stories, grieve with you, rejoice with you, and offer a human experience that can never be replicated—even with all the knowledge in the world at their fingertips. Human providers all have healthcare stories of their own, and their ability to empathize with you is not based on programming. It ultimately comes down to us as healthcare leaders understanding that we should not jump into new technologies, no matter how efficient or lucrative they may seem.
We have a responsibility to ensure any new technologies only enhance our abilities and 'do no harm,' and this only seems preservable by retaining the human touch in healthcare only providers can deliver.
Care to share your view? HealthLeaders accepts original thought leadership articles from healthcare industry leaders in active executive roles at provider and payer organizations. These may include case studies, research, and guest editorials. We neither accept payment nor offer compensation for contributed content. Send questions and submissions to Erika Randall, content director, erandall@healthleadersmedia.com.
The Atlanta-based health system is incorporating NeuroFlow's digital health platform into a new collaborative care model aimed at improving behavioral health treatment in primary care clinics.
Emory Healthcare is embracing digital health tools in a new program designed to integrate behavioral health services at primary care clinics.
The Atlanta-based 11-hospital, 250+ site health system and the Goizueta Institute @ Emory Brain Health are partnering with NeuroFlow to complement and scale Emory's collaborative care model (CoCM), part of the health system's Integrated Behavioral Health (IBJ) program, as part of the effort to improve access to behavioral health services throughout the Emory Healthcare network.
That includes adding in NeuroFlow's digital health platform, which gives patients on-demand access to psychotherapy resources, including self-directed content, and charts a patient's progress in key mental health benchmarks between office visits.
“We want to be able to reach patients in a timely manner and bring treatment to where they are most likely to be identified as having a psychiatric problem, which is the primary care setting,” Brandon Kitay, MD, PhD, an assistant professor of psychiatry and behavioral sciences and director of Emory's behavioral health integration, said in a press release.
“While CoCM is a robust, evidence-based practice model with clear benefits for patients, it has a lot of moving parts that make it difficult to sustain and scale," he added. "We hope that leveraging innovative technologies that integrate patient data directly into our medical record system will extend our reach, afford new opportunities to interact with patients between scheduled visits, and scale our clinical volume by relieving some of the administrative burdens through more efficient infrastructure."
"This collaboration introduces the type of technology needed to assist our healthcare providers and patients in bridging the gap between mental and physical health," William McDonald, PhD, chair of Emory's Department of Psychiatry and Behavioral Sciences, said in the press release. “While our teams already practice collaborative, integrated care, this partnership serves as a driving force to expand and enhance these endeavors throughout the Emory ecosystem, ultimately resulting in improved outcomes and reduced costs.”
The collaboration is also highlighted in a pilot program targeting suicide prevention. The platform will be used to identify patients at real-time risk of suicide and generate alerts to providers.
“Suicide is the eleventh leading cause of death in the United States and the current approaches of identifying and responding to patients at risk of self-harm are not sufficient to address this crisis,” Kitay pointed out. “This collaboration gives our clinicians more data points and key insights they need to better identify warning signs and help save lives.”
A discussion at the HIMSS 2023 Interoperability Showcase highlights the barriers to data transfer between ambulances and hospitals.
As healthcare organizations learn to use technology to gather, store, and analyze data, interoperability is fast becoming a crucial tool. Health systems need a common framework and standards to share data with other healthcare providers and sites.
That includes EMS providers, which are often overlooked in the national effort to create a nationwide healthcare exchange. They're on the front lines of emergency care, and it's crucial that they be able to share information with a hospital before and during transport. New and improved tools and technologies are making that process easier, but interoperability issues are still common.
As an example, "consider prescription medications and substance use challenges," says Jonathon Feit, MBA, MA, co-founder and chief executive of Beyond Lucid Technologies. "Substance use challenges [can] fester into overdoses due to a lack of visibility into patients’ encounters with care settings across jurisdictional lines. If a patient in Ohio sees a doctor in West Virginia, Kentucky, or Indiana, there is presently no mechanism for the Ohio-based fire or ambulance crews, or hospitals, to know what medications the patient should have been taking, which makes it much harder to surmise what she or he likely took."
"A takeaway from these meetings is that data-sharing tools exist," says Feit. "The desire to share data exists. Data-sharing agreements are well-worn policy landscapes. And yet, why are resource-rich hospitals unable to close the mobile medical data gap?"
Feit notes that in 2020, the Cleveland Clinic, Essentia, and Sanford Health reported they were unable to integrate ambulance-based data into the Epic platform, even though Epic had published the data import specifications on its website.
Feit sought answers to that dilemma at the HIMSS 2023 conference and exhibition this past April in Chicago, where he visited the HIMSS Interoperability Showcase and talked with executives from Epic and ImageTrend who were demonstrating EMS-to-hospital interoperability. He asked them how data collected on ImageTrend's ePCR (electronic patient care report, similar to an ambulance-based electronic health record) could transfer discretely into the Epic EHR.
"The results were enlightening," Feit says. "And more than any other conclusion, they proved the dire need for a shift toward nuanced messaging in technical advertising."
Feit says he asked whether discrete data was showing up in the right places within the Epic EHR. Two Epic software developers, Patrick Kastelik and Michael Donnelly, told him the EHR platform wasn't recognizing discrete data from ImageTrend, including EMS-specific CDA templates.
"The distinction of discrete versus PDF transmission matters," Feit says. He noted several jurisdictions are waiting on discrete data import and interoperability, including the state of California, which was singled out by the Office of the National Coordinator for Health IT for its SAFR (Search, Alert, File, and Reconcile) model, and New York City Health + Hospitals, which in 2021 announced that its interoperability goals would depend on a city-wide model for automated matching and sharing of ambulance-based records from the Fire Department of New York and other medical transportation services with EHRs and regional health information organizations (RHIOs).
"Their goal is to have access to discrete data for a range of mutual benefits," Feit adds, "including the ability to query data for demographics (for example, identification of patients), missing billing information, and the clinical goals that ImageTrend Director of Strategic Development Doug Butler described as 'taking patients directly to CT, handing off the labs, pre-registering the patient, [and] all those things [that are] going to reduce that time and improve those patient outcomes.'"
According to Feit, ImageTrend has been able to create a PCR, validate, and post the chart, which then automatically creates an ADT (admission, discharge, and transfer) record in the Epic EHR. This gives the hospital notice that patient data is available in real-time, so that staff can begin preparing for the patient's arrival.
According to Feit, Butler said that while the process is automatic, some EMS providers still don’t chart their data until after the transport is concluded. In some cases, Butler said, EMS providers scan a patient's driver's license before charting.
Feit says EMS providers need to send that data immediately, not wait until the end of a call. That's especially true during 911 calls and other emergencies, when a hospital needs as much information on a patient as it can get before that patient arrives. Information that is added to the patient's record later on might not be useful by then, and it may have been important enough to affect patient care.
From his time at HIMSS, Feit offers two conclusions.
"First, the barrier to optimization of information sharing—the realization of a grand vision for connected healthcare—is often not about the technology itself," he says. "Indeed, the bits, bytes, and APIs may be the easy part. The hitch is more frequently in the design: If maximation of interoperability means that systems must be deployed in the field, at the patient’s side, as ImageTrend and Epic showcased together, then the user interfaces must be built for ease of use in the field."
"We know that, for example, approximately half of the ambulance services in Oregon use ImageTrend as their documentation system," Feit says, "but … nearly half do so only at their desktops—not in the field—which has major implications for the ability to present critical health data. Mobile medical agency leaders have to ask themselves: How important is it that they be able to capture and share data in real-time and, as a result, improve clinical intervention, patient identification, billing, response to a range of emergencies including those involving social determinants of health and harmful substances, respect for end of life wishes, care for chronic care patients, and syndromic surveillance?"
"Second," Feit says, "organizations like the State of California, whose SAFR model is far from ubiquitous, should not only trumpet successes but also failures. If the NEMSIS Technical Assistance Center and IHE aim to promote innovation, citing examples like SAFR as advances worth replicating, then it is essential to understand not only why and where those worked, but also, where applicable, why didn’t they work better?"
Feit's point is that EMS providers, health systems, and tech companies have to work together to solve the pain points that make interoperability such a challenge. This includes understanding why data isn't flowing into the EHR from EMS platforms, as well as making it imperative that data be entered and sent immediately, not when the call is over or the shift ends.
In a special Nurses Week episode, Healthleaders editor Melanie Blackman speaks with Sharon Pappas, RN, PhD, NEA-BC, FAAN, chief nurse executive for Emory Healthcare, who explains how chief nurses are finally becoming full strategic, influential partners in their organizations after decades of not being recognized as part of a hospital’s executive organizational team.
Backtracking from an earlier proposal that drew heavy criticism, the agency is extending pandemic waivers for the use of telemedicine to prescribe controlled substances until November 11.
Federal officials have extended for six months pandemic waivers designed to enable healthcare providers to prescribe controlled substances via telemedicine.
The announcement, posted this week in the Federal Register, follows a busy few months in which the US Drug Enforcement Administration proposed new rules around telemedicine prescriptions, set to take place when the public health emergency (PHE) ends on May 11, then backtracked after received thousands of comments criticizing those rules.
“The DEA received a record 38,000 comments on its proposed telemedicine rules. We take those comments seriously and are considering them carefully,” DEA Administrator Anne Milgram said in a press release issued on May 9. “We recognize the importance of telemedicine in providing Americans with access to needed medications, and we have decided to extend the current flexibilities for six months while we work to find a way forward to give Americans that access with appropriate safeguards.”
“Access to evidence-based treatment is a pillar of the HHS Overdose Prevention Strategy,” added Miriam E. Delphin-Rittmon, the Health and Human Services Department's Assistant Secretary for Mental Health and Substance Use and the leader of the Substance Abuse and Mental Health Services Administration (SAMHSA), which is assisting the DEA. “We strongly support policies that promote access to effective and safe treatment for opioid use disorder, including through telemedicine platforms, and ensuring continued access to necessary controlled medications past the COVID-PHE.”
The temporary rule taking effect on May 11 will extend the full set of telemedicine waivers adopted in January 2020 to expand telehealth access during the COVID-19 pandemic through November 11, 2023. For providers who have set up a telehealth relationship with a patient for the prescription of controlled substances, the waivers will be extended through November 11, 2024.
The proposed revisions to the telemedicine prescription guidelines unveiled in February drew strong comments from a wide range of stakeholders, including the American Telemedicine Association (ATA), the Alliance for Connected Care, and a group composed of members of the Brookings Institution, Harvard Medical School, David Geffen School of Medicine at UCLA, and Harvard T.H. Chan School of Public Health.
Also weighing in were members of Foley & Lardner's Telemedicine & Digital Health Industry Team.
"The proposed rules are intended to bridge between the DEA’s current PHE waivers and a post-PHE environment," Nathaniel Lacktman, a partner with Foley & Lardner and the digital health team's chair, wrote in the firm's Health Care Law Today blog. "In so doing, DEA proposed creating two new limited options for telemedicine prescribing of controlled substances without a prior in-person exam. The options [are] both complex and more restrictive than what has been allowed for the past three years under the PHE waivers. The DEA’s proposal will discontinue the ability for telemedicine prescribing of controlled substances where the patient never has any in-person exam (with the exception of an initial prescription period of no more than 30 days’ supply). Moreover, if the patient requires a Schedule II medication or a Schedule III-V narcotic medication (with the sole exception of buprenorphine for opioid use disorder (OUD) treatment), an initial in-person exam is required before any prescription can be issued."
News that the DEA was changing course was met with positive comments from the ATA.
“The ATA and ATA Action strongly commend the actions that the DEA has taken, jointly with SAMHSA, in temporarily extending flexibilities for the remote prescribing of clinically appropriate controlled substances," Kyle Zebley, the organization's senior vice president of public policy and executive director of its ATA Action lobbying group, said in a press release. “It is especially important and encouraging that these actions cover access to clinically appropriate prescriptions of controlled substances that patients need for a wide variety of medical circumstances, including for mental health and substance use disorders."
“We are hopeful that during this extension period, the DEA will revise the draft rules to address unnecessarily restrictive barriers to equitable and appropriate clinical care, such as mandating in-person visits," he added. "The ATA and ATA Action are committed to continuing our work with the agency and others to help create the most effective and appropriate rules that ensure access to needed treatments."
Passed into law in 2008, the Ryan Haight Online Pharmacy Consumer Protection Act severely restricts the prescription of controlled substances, and requires an in-person exam by a qualified provider before those drugs can be prescribed via telemedicine. Enforcement is handled by the DEA.
Writing in their Health Care Law Today blog earlier this year, Thomas Ferrante and Rachel Goodman, partners with Foley & Lardner and members of the Telemedicine & Digital Health Industry Team, said the waiver of the in-person exam during the PHE ensured that "millions of both established and new patients were able to receive medically necessary prescriptions via telemedicine."
They also pointed out that the DEA's actions this year don’t address a key element of the Ryan Haight Act.
"There have been efforts to amend the Ryan Haight Act and encourage the DEA to activate the telemedicine special registration rule before the PHE expires, including pending federal legislation," they wrote. "However, to date, the Ryan Haight Act has not been changed and the DEA has not activated the telemedicine special registration rule."
"The DEA’s proposed rules are not the special registration process that Congress mandated and could gravely disrupt millions of patients’ treatments and care regimens," Robert Krayn, co-founder and CEO of telepsychiatry company Talkiatry, said in an e-mail to HealthLeaders. "Instead of taking inspiration from more modern state-level prescribing policy already introduced in Connecticut and Florida, the rules reinstate obsolete and counterproductive in-person requirements under the guise of novelty. There is nothing novel about sending vulnerable patients back into the dark ages of care delivery."
The Oregon hospital's director of information systems talks about lessons learned from a 2020 attack by Russian hackers that forced executives to shut all systems down.
Ransomware attacks are a serious threat to healthcare organizations, and nearly every hospital has a strategy in place to deal with one if it happens. But those who've experienced such an attack say even the best-laid plans go awry, and the best strategy is to expect the unexpected.
"We had downtime processes that worked very well for the first 24-48 hours," says John Gaede, director of information systems at Oregon's Sky Lakes Medical Center. "And then they all broke down. We had to invent a lot of what we did in the moment."
Located in Klamath Falls, near the California border, Sky Lakes Medical Center nestles alongside Klamath Lake, surrounded by forests in a high desert region 60 miles south of the Cascades. The area is a popular recreation destination, yet in October 2020 that calm was shattered by a group based halfway across the world in Russia.
According to the FBI and Health and Human Services Department, the hospital was one of a dozen attacked at the same time by Ryuk ransomware threat actors, a group known for being able to change methods on the fly to evade detection. The attack lasted roughly three weeks, though the recovery process took a lot longer and prompted Gaede and his colleagues to re-examine their protocols.
"We've gone to every single department to document what was done before we forget this," he says. "We haven't even finished that playbook yet, but we've learned some valuable lessons."
John Gaede, director of information systems, Sky Lakes Medical Center. Photo courtesy Sky Lakes Medical Center.
Among them, Gaede says: Make sure your partnerships with tech vendors are strong and lean on them for help. And be prepared to be surprised and versatile enough to react to those unexpected effects.
"It's people, processes and technology," he says.
The attack occurred just after noon on October 26, 2020, when an employee clicked on an e-mail with a link that supposedly discussed a bonus (not an unusual or unexpected e-mail, Gaede says). The file was downloaded from Google Drive, and at the same time the employee's computer blinked, and the employee rebooted the computer. Nothing seemed out of the ordinary, so the employee didn't alert anyone.
By 11 that evening, Gaede says, the first encryption efforts were conducted on Windows-based systems, and soon after all systems were slowing down. At 3:30 a.m., he got the phone call from IT alerting him of the ransomware attack.
Suddenly it was all hands on deck. Gaede says they turned to their Vocera communications platform to restore functionality, but everything there was encrypted within minutes.
"We then realized we had to shut everything down," he says.
Now, "shutting down" is a terrifying thought. The 176-bed hospital had to go offline immediately, taking down more than 2,500 PCs and 600 servers and halting some clinical care services, alongside all of the connected care aspects of a hospital serving roughly 120,000 people in a relatively remote area. Even maintenance and environmental services were affected.
This is where the best-laid plans often break down. Hospitals can train their personnel on what to do in the event of a ransomware attack, going through a number of different scenarios and if-this-then-that situations, but eventually the ramifications prove too complex. It's one thing to map out all the results of putting the EHR platform into a downtime mode, and quite another to understand how that affects business operations such as supply chain, pharmacy, and revenue cycle.
For instance, just as the snow was beginning to come down in Oregon, Gaede suddenly found out they didn't have heated sidewalks.
"At this point, every system is not happening," he recalls. "We didn't know what had been compromised. We realized this wasn't going to be easy, and it wasn't going to be like we had planned."
Gaede says hospital executives huddled quickly that morning and then went into action. Asante, the health system located some 70 miles distant in Medford, Oregon, was alerted. The hospital's insurance carrier was contacted, as well as Cisco, which sent in its Cisco Talos. In short order, both Cisco Talos and Kivu Consulting were helping with recovery efforts.
"We had to completely rebuild our network," Gaede says. "That's a laborious process. We had to build backups and test them first to make sure they were clean, then run the [main systems] through tests to validate that they can work. We didn't want to start something up, have it [integrate] with another system and have everything fall apart."
Ironically, doctors and nurses who had spent the last 18 years getting used to the EHR platform now had to go back to the old way of doing things. Bar-code scanning was out, as was typing data into the system, or even jumping online to track down information or do research. Copper line fax machines were back in vogue—though one literally blew up from overuse.
Everything was now written on paper or spreadsheets, and data and messages were conveyed from one department to another by runners, in what came to be called the 'sneakernet.' The hospital ran out of prescription pads, and local retail outlets were swamped with requests for paper.
"Few of them had been trained on how to do medicine on paper," Gaede says. "We went to Walmart [and] Staples and bought all the paper they had."
The hospital also had to shut down its PACS system, and for several days couldn't provide any imaging. Gaede says they contacted Sectra/Electromek, which came in and built a whole new system on the AWS cloud, so that images could be read on an iPad by the following Friday (the RIS was enabled by Saturday). 3M M*Modal then came in to integrate their services for reporting.
On November 9, radiation oncology was back up, and on November 23, the hospital restored its Epic EHR platform, alongside a fully operational PACS and radiology system. While things certainly weren't "normal" at that time, Gaede says everyone in the hospital was able to take a deep breath and relax a bit.
"It was like a brand-new go live," he says.
He says some clinical care was affected, though it's hard to translate that into clinical outcomes. Some services were delayed, some patients were inconvenienced, and Sky Lakes executives, clinicians and staff were all put through the ringer.
The hospital's revenues and cash flow were also affected, forcing executives to dip into cash on hand to make sure everyone got their paychecks. Gaede says the incident will affect their business plan for about three years, with more money invested in security and data protection.
"We were just trying to take care of our community, and we had no notion that state actors were taking aim at us. The potential impact to patient care and patient harm was absolutely real," he says.
But the hospital's disaster plan held up, for the most part. Legacy backups from Cohesity worked as they were supposed to, staff knew what they had to do or they knew how to react when they didn't know what to do. Requests for help were answered, and no ransom was paid.
"We made it a point right from the start that we would be transparent about what happened," Gaede adds. "It was very important to us. And I can look back now and feel we did the right things. Hopefully this will help others in the future."
