Chris Mazzolini is the editorial director of Medical Economics

Chris Mazzolini

Editor's note: The information is this story was taken from a recent Medical Economics Bootcamp session. You can find the full video of the session 

There are two crises in medicine that have converged in recent years, which include the aftereffects of the COVID-19 pandemic and an increase in burnout among physicians, but this overlap is not all negative. Many physicians, burned out from the administrative hassles that come with running a volume primary care practice, are using the upheaval caused by COVID-19 to reevaluate their careers and are considering a membership-based model.

A discussion about this reset opportunity was the focus of this bootcamp session, featuring a conversation with a burnout expert. The following transcript was edited for length and clarity.

Understand how burnout impacts physician work-life balance, mental health and medical errors.

Learn why now is the time for self-reflection and exploration of ways to improve physician career satisfaction.

Listen to an open discussion about the various strategies to alleviate burnout.

Discover why a membership-based model can help reduce burnout and enhance physician work-life balance.


Vice President of Physician Development
MDVIP


Professor of Industrial-Organizational Psychology
Davidson College

Burnout, COVID-19 and the ‘Great Reset’

 Do you think the psychological impact of COVID-19 will continue to affect physicians as they learn how to live in this next normal?

 Yes, the COVID-19 pandemic is not something that happened once, then went away. It is similar to the Great Depression. The Great Depression changed the people who grew up during that time, so we will not be the same people we were. We cannot just be carried along by the next fad or wait to deal with the next crisis; it’s up to us to design how we want our future to be in the remaining chapters of our lives. I’m going to sound like a psychologist here: The remaining chapters of our lives have not yet been written. Physicians should ask themselves, “What can I control? What can I do differently so I’m not, once again, dealing with all this bureaucratic work that’s impacting my autonomy?” Doctors need to take care of their body and mind, and that often requires rethinking their business model, rethinking how they do what they do.

 You brought up how physicians should consider recrafting their careers, but these days, physicians have been conditioned to be strong and persevere. Why is it so difficult for physicians to take care of themselves the same way they look to take care of their patients?

 It’s their sacred mission to take care of others. Physicians are the best of the best, but they’re susceptible to breaking down as much as anyone else. When that happens, it’s horrible for them, and it’s hard for their patients. Physicians tend to think they can tough it out. Nearly half of all the responding physicians in a national survey said, “My strategy for managing stress is to isolate myself and not burden others with it.” They would never advise this to one of their patients.

 In your presentation, you talked about how a crisis can be the right time for someone to explore something new, possibly a new business model. In the midst of ongoing uncertainty in healthcare, how is this applicable to physicians?

 You can experience a crisis and the aftermath of a crisis in a variety of ways. You can think, “Poor me. Life is bad. I lost two years of my life. I’m not happy.” Or you can say, “This is an opportunity.” Again, I would not have chosen this as the trigger for the Great Reset, but now physicians can be empowered to look at their own life and redefine how they want it to be. If you go back to the same version of your old normal, you’re missing a tremendous opportunity. This is your chance to take action and find a solution that allows you to have more control and autonomy over your life, in whatever form that is. Some physicians are leaving the profession. I am not recommending that, but we’re seeing a potential nurse and doctor shortage in several areas. I want physicians to recognize that they’ve been on the hamster wheel, running harder and faster, and running the risk of wearing themselves down and burning themselves out. Instead, doctors should be asking themselves, “How do I get back to providing quality care for my patients in a way that nurtures them, cares for them and allows me to have work-life balance?” It’s not out of reach.

 Let’s say you have a physician who’s recognizing some signs of burnout, recognizing that things need to change and recognizing that they are not practicing medicine the way they would want to because of stress. It’s human nature to avoid change. How can physicians get past barriers they set for themselves?

 Think about it like this: Change has been imposed on us by the pandemic, so it might be difficult for physicians to want to make a change if they feel they’ve been successful with their current strategy and believe their life is good and they’re okay. Maybe they don’t see reasons to change. But if you’re constantly running on the hamster wheel or the pandemic has increased your stress level dramatically, you don’t have a constructive choice. You’re on the burning platform, and you have to make a change. It’s time to self-reflect: What’s your vision if you make a change? Where does that take you? What are your goals? Maybe the answer is work-life balance, taking care of your family, having enough income and making a positive difference. So, now that you know what’s driving you to change and have directional clarity, how are you going to get started? What are your first few steps?

 With your research, you’ve had a unique opportunity to take an objective eye and observe what’s happening in the business of medicine and what’s influencing physicians both positively and negatively. In your professional opinion, do you recommend doctors explore other practice models that might better meet their needs?

 The short answer is yes. A lot of the physicians we interviewed, and some I have read opinion pieces from, have said they simply had to get out of a huge hospital practice or another gigantic system to get more control, manage their workload and be able to continue to deliver the kind of healthcare they want to provide. There are alternative business models available. Again, one of the primary culprits that impacts a lot of primary care physicians is the prevailing volume-based, fee-for-service business model. That’s not a business model anyone with a blank sheet of paper would have ever designed, but it’s now the standard for primary care, and it unfortunately keeps doctors in the cycle of having to see more patients with less time per patient to maintain their income. It is a chief underlying contributor to the stress everyone’s experiencing. So, while we’re waiting for the government to change regulations to make it easier for physicians to manage their load, physicians have to look at their own business model.

Articles

Many physicians, burned out from the administrative hassles that come with running a volume primary care practice, are using the upheaval caused by COVID-19 to reevaluate their careers and are considering a membership-based model.

Summer Bootcamp: Burned out? How membership-based primary care could be your career reset

Ransomware has never been a more serious threat for health care organizations, even small medical practices. So what should be done about it? Is it possible to defend yourself? Are there insurance products that can help protect your business in the event of a breach? To discuss these issues, 

® sat down with Peter A. Halprin, Esq., a partner in Pasich LLP’s New York office who specializes in complex insurance coverage matters in relation to cybercrime. The transcript below was edited for length and clarity.

Let’s put the ransomware issue into context. How big of a problem is it in health care?

 It is a massive problem. We’re talking about billions of dollars in impacts. And I think the average cost of a breach tends to be around $2 million, with about 10% of that being ransomware payments, and the rest being recovery. As I said, the numbers are going up and up and up. So any number I’d give you is already stale. Unfortunately, the trend is only going to continue.

I think health care is a particularly risky sector in this regard for two reasons. One is there is lots of personal information. So data-rich target, if you will, and then the flip side being you’ve got a lot of proprietary systems, you’ve got a lot of older systems that haven’t been updated, don’t get regularly updated. I think in some ways, doctors, like lawyers — they’re focused on their craft. And they’re not necessarily focused on these other things, assuming, Why would anyone do this? Why would anyone target a medical facility or doctor’s office or anything else? And the answer is you’re a target-rich environment and (cybersecurity is) not a priority. So I think health care has continued to be a particularly fertile source for ransomware actors.

ME: How has the COVID-19 pandemic affected cybersecurity?

: Negatively, for sure. I think that the bad guys have taken advantage of people working from home, people being distracted. It’s very hard to stay focused on your tasks. All of a sudden, you get an email that comes in and it looks very convincing. And I’m telling you, the bad guys are bad. For example, people were getting emails in March of 2020 talking about the cure for COVID-19, or the email looked like it was coming from the World Health Organization or the CDC. So they took advantage of that. Cyber hygiene was definitely down.

I think the other side of it is that the bad actors are targeting specifically vulnerable institutions and organizations. So we saw attacks on vaccine research centers, hospitals, doctor’s offices. For those vulnerable sectors, part of their vulnerability is that it is a matter of life and death. The bad actors take advantage of that vulnerability.

ME: Is being targeted by hackers inevitable?

: I’m hesitant to say that it’s inevitable because I don’t want people to just throw their hands up, so I don’t love the word. But it is highly, highly probable that there will be an attack or there will be some form of cyber incident or cybercrime involving a health care institution.

So the question is, knowing that there’s that high probability, how do you address that? You really want to beef up your security, what I call cyber hygiene. It’s protecting your business, it’s making sure that people don’t click those bad links, it’s making sure that you clearly identify when an email comes from an outside source, it’s making sure that sensitive areas in a business are closed off so that people can’t penetrate security.

The second instance can come in the form of limiting access. If someone’s able to access your account, then they can get no further than what you can access. It’s that kind of internal security.

ME: What about cyber liability insurance?

Halprin: Yes, the third layer is cyber insurance. So you get insurance for when things go wrong. This is the same kind of product. Once you have that in place, remember, it’s not a fail-safe; it’s not a defensive system. That’s why I say it’s the third and final resort. But it offers two things. It offers bottom-line protection: Let’s say you have $10 million worth of coverage, and then the bad thing happens. You know that you can be restored up to the $10 million that hit your bottom line.

The other thing that cyber insurance often entails is breach response services. So they can help you build out a program to protect yourself when something happens. They can provide you with vendors, they can provide you with legal counsel, they can provide you with public relations experts, and so they can help build that suite of services around you and your business that are needed to deal with an incident.

Now, most businesses have their own cybersecurity plans and their own incident response plans. One of the biggest flaws that I see in incident response planning is that a company will have its own incident response plan, and then it will also have these cyber insurance resources, but they won’t be integrated. And so the problem there is if you use your own people, and you don’t get consent to use them, the insurance company might say, Hey, we’re not paying for that. So the best thing that you can do is work to get insurance involved on the front end working to make sure the insurance company signed off on the plan so that seamlessly integrates. So when something bad happens, you can bring all those resources to bear.

ME: Should health care organizations ever pay the ransom?

: This is probably one of the trickiest moral and ethical dilemmas for businesses. As a lawyer, I can’t advise anyone to break the law. And if you speak to law enforcement, the overwhelming suggestion is don’t pay. The reason they don’t want you to pay is they don’t want the criminals to be incentivized to continue doing what they’re doing. There are also sometimes actors that are on the sanctions list, right? They’re people that we as a country do not permit our citizens to engage with. So there are a lot of considerations as to why it’s not a good idea to pay.

One other consideration about not paying is sometimes you pay and the actor stays in your system and continues to extort. So you’re not even promised that you’ll get free and clear access from paying. And then even the worst part is, you could get free and clear access, but everything’s corrupted now that they’ve left. And so you get very little for what you pay. Those are all the reasons not to.

But what I think businesses often do practically, especially those in the health care space, is they just pay. I can’t give you a number or a statistic. But overwhelmingly when clients are hiring me and they’re fighting with their insurer; oftentimes it’s because they want to get the insurer to cover the ransom. And I would say if you have a cyber policy that covers ransomware, insurers are amenable to you making those payments and to reimbursing those payments.

ME: Something we often hear from physicians at small or solo practices is they don’t believe they are really being targeted. How true is that?

: It’s not true at all. It’s more kind of a buckshot and goes in a lot of different directions. I don’t think (hackers) are necessarily saying, I want to hit small practices in the Midwest, but it may necessarily end up being that way. There are targeted attacks, for sure, which do end up hitting the larger organizations, but I think that for the smaller medical practices, it’s not necessarily because they picked you. It was more that you happen to have a vulnerability that’s not patched.

ME: Is there anything else that’s important for physicians to know about the subject that we haven’t discussed?

: Just to take this seriously. Some of the questions that physicians have: If I’m going to get hit with this anyway, what’s the point? Why bother? I think the answer is you still want to be prepared. And you still want to take precautions. Because if you’re too nonchalant about it, it could end your business.

As ransomware attacks continue to strike practices across the country, is your practice prepared to defend against them?

Is your practice ready for a ransomware attack?

Health care is a stressed out industry. And sometimes, stress and burnout can lead to frustration and incivility between colleagues or even with patients.

Practices that are experiencing incivility issues can fix things. It’s not easy, but there are steps to take. This was a topic during the HIMSS22 Global Health Conference at the sessions, “Promote Effective Interpersonal Communication” hosted by Edward Klatt, a professor at Mercer University School of Medicine.

Klatt’s presentation outlined 12 steps to restore civility at your organization. Check out the slideshow.

Restoring civility at your practice

Slideshows

A 12-step program for removing negative communication habits at your practice.

Refusing to share records and data with patients in a timely manner can result in an accusation of 

, which could someday soon lead to a fine.

Federal health care agencies have been trying to halt information blocking, and have been warning provider and other organizations that enforcement action is coming soon for organizations with data blocking complaints lodged against them.

 Global Health Conference in Orlando, health and human services Secretary Xavier Becerra 

 HHS has received regarding organizations barring access to patient data. More than 75% of the complaints about information being blocked have involved health care providers, Becerra said.

One patient wrote about awaiting to hear about a biopsy and being told the results are available, but the patient couldn’t get the results yet, because the doctor was out of town, Becerra recounted.

“Closing this enforcement gap is an HHS priority,” Becerra said.

Becerra didn’t specify what penalties may be coming for information blockers. But he said HHS will have more to share on enforcement measures later this year. When it comes to providers blocking information, the health secretary makes the decisions on penalties, he said.

Information blocking is action by someone (a medical practice, hospital, vendor, etc.) to interfere with access, exchange or use of health data, according to Arthur W. Harvey III, senior vice president and chief information officer for Boston Medical Health System, during a HIMSS22 presentation

Essentially: If a patient wants access to their health data, you have to give it to them. There are exceptions (eight of them, including preventing harm, privacy, infeasibility) and the records don’t have to be provided for free.

Organizations have many reasons for blocking information. Deven McGraw, chief regulatory officer for Ciitizen, explains that many are 

 to privacy concerns, and because they view data as a business asset.

The 21st Century Cures Act standardized the process for the public to report claims of possible 

, which is a practice by a health IT developer that is likely to interfere with the access, exchange, or use of electronic health information.

 has created a standardized process for the public to report claims of possible information blocking via a portal, which launched April 5, 2021. Since that time, 274 cases of possible information blocking have been reported.

Of these claims, 174 were filed by patients, 42 by attorneys on behalf of patients, and 32 by health providers, with the rest coming from IT developers or third parties. Of those suspected of information blocking, 211 are health care providers and 42 are IT developers. Provider is defined by ONC as a hospital, health facility, or physician, among others.

 has provided examples of practices that may constitute information block:

Fees are imposed that make exchanging electronic health information cost prohibitive.

An organization’s policies or contractual arrangements prevent sharing or limit how information is shared with patients or their healthcare providers.

The HIPAA Privacy Rule is inappropriately cited as a reason not to share information.

Healthcare providers or IT vendors limit or discourage sharing information with other providers or with users of other IT systems.

Technology is designed or implemented in non-standard ways that lessen the ability to exchange and use information with other IT systems, services, or applications that follow nationally recognized standards.

Patients or healthcare providers become “locked in” to a particular technology or healthcare network because their electronic health information is not portable.

Why blocking patient access to their records can cost your practice

It’s harder than ever to hire and retain staff at medical practices. The so-called “Great Resignation” in the wake of the COVID-19 pandemic has created a vexing staffing environment for businesses of all kinds, but especially medical practices and other health care providers.

Furthermore, the challenge for practices is that staff members won’t put up with difficult internal cultures anymore, and a turbulent staff environment has a direct impact on the quality of the patient care you provide, said Heather Towery, MD, the vice president of clinical strategy for Eden Heath.

“Making sure your employees are in engaged is key to your success as a company,” Towery said.

Towery spoke during the HIMSS22 Global Health Conference in Orlando as part of a session called, “Better Patient Care Starts with Engaging Internal Culture.”

The data shared by Towery and her co-presenter, Krystle Castillo MSN, APN, FNP-C, was stark. One in 4 employees have voluntarily left their employment during the pandemic, according to Towery. That has a staggering cost for practices: It can cost 33% of an employee’s annual salary to replace them.

Employees have been quitting for a variety of reasons, said Towery, but the leading ones according to 2021 data from the Achievers’ Workforce Institute are:

To find an employer that better recognizes them (16%)

To find an employer with better internal culture (8%)

Furthermore, nearly half (44%) of health care workers are interested in changing jobs, even if they have not seriously tried yet, Towery said.

The benefits of creating an employee engagement campaign to improve your culture can be transformative to your business by increasing profitability and productivity with corresponding decreases in turnover.

So what can practices do about this? There are four steps, Towery said.

Roll out the red carpet. “You want your employees to feel loved,” Towery said.

Multidisciplinary, regional team breakdown.

Design meaningful meeting structures. “Meet every day,” Towery said. “Huddling is important to get everybody together and get to know each other and what people do.”

Align incentives and give meaningful recognition.

Give employees opportunities to provide significant input.

It’s harder than ever to hire and retain staff at medical practices. Here’s what you can do about it.

Patient care won’t improve until your internal culture does

The HIMSS22 Global Health Conference kicked off its general programming Tuesday in Orlando with a modest goal: To motivate thousands of physicians, tech CEOs, cybersecurity experts and others to “realize the full health potential of every human, everywhere.”

Those were the words of HIMSS president and CEO Hal Wolf, delivered at a challenging time for the global healthcare system. There’s a pandemic, of course. There’s increasing awareness of how inequal health outcomes are across the globe. There’s tension between an inefficient encounter-based health system on one side, and a digital health ecosystem that sometimes is too impersonal.

The problems, Wolf said, remain well known.

“Too many patients, not enough resources, not enough information, still” Wolf said. “The medical model is at a breaking point. You know, because you are living it every day.”

Wolf said the great challenge facing health care leaders today is to merge the two models, the in-person physician visit with population health, predictive modeling, and artificial intelligence and machine learning.

“There will always be the need for what we do every day in our clinics, our hospitals, our facilities,” Wolf said. “But it’s not enough. Our fundamental challenge is to weave these models together and realize the best of both worlds.”

The bottom line is that patients are approaching their health care as consumers, and they want digital care. They want their health app data to be part of their care plan, they want telehealth.

“We must embrace disrupters, because patients will,” Wolf said.

We will have ongoing HIMSS22 coverage this week on Physicians Practice. Check out our HIMSS conference page for more.

The HIMSS22 Global Health Conference kicked off with a motivational challenge for the health care industry.