Joseph E. Guimera, JD

Delivering quality care may no longer be enough to maintain a successful medical practice. Today’s patients are more informed and empowered, and demand convenience and excellent customer service. They routinely go online to research practices before making an appointment and do not hesitate to share their experiences, good or bad, on social media or review sites like Yelp, Zocdoc, and HealthGrades.

The patient experience, which encompasses all interactions between the patient and a practice from appointment scheduling to interaction with physicians and staff to follow-up visits, has become a top concern for practices as it affects physician online ratings, practice reputation, and patient acquisition and retention.

For practices seeking to adopt patient-centered approaches, digital technologies can help alleviate many common patient complaints while also increasing practice-wide efficiency. Let’s take a look at a few digital solutions. 

Patient portals can serve a variety of functions. A well-designed, secure patient portal allows the patient to be in control of their healthcare by providing 24/7 access to their personal health information from anywhere with an Internet connection. Patients can use the portal to schedule appointments, communicate with doctors and staff, request prescription refills, access medical records, receive test results together with clinician’s notes and interpretations, pay bills, check benefits and coverage, and view and complete patient forms.

Portals also provide more efficient ways to deal with various administrative tasks. Practice staff spend less time on the phone with patients handling routine but time-consuming tasks such as appointment and medication refill requests and inputting information onto the patient’s chart, thus freeing up time for more urgent matters.

Patients often complain about the time required to check in for a medical appointment. Providing for electronic self-service check-in through a smart device or kiosk can significantly reduce check-in time for most patients.

A check-in application identifies the patient, determines whether any additional information or consent forms are required (and if so, prompts the patient to complete the intake process), informs the patient whether a co-pay is applicable and accepts credit card payment for the co-pay, and updates the patient’s records. Following check-in, the system can instruct the patient to go, for example, directly to an examination room, to a staff member for additional assistance, or to the billing department to discuss an outstanding balance.

Self check-in results in a quick, paperless process that eliminates the need to check in each patient individually and allows staff to focus on patients needing special attention.

A chatbot is a broad term used to describe automated conversation systems powered by artificial intelligence. It can be anything from an automated text program residing on a website, patient portal, or separate application to a virtual assistant like Amazon’s Alexa or Google’s Assistant. Chatbots are widely used in industries such as retail to improve customer service and are gaining acceptance in healthcare.

Available 24/7, chatbots provide an efficient, cost-effective method of communicating with patients and can be used for various purposes. Chatbots can answer patient questions, help navigate your website, provide patient education on diseases and conditions, instruct the patient on procedures (for example, preparing for a colonoscopy), assist with medication management, and monitor chronic conditions.

Physicians spend seven to twelve minutes per patient on face-to-interaction. A large part of this time is spent with the physician looking at a screen entering notes rather than fully engaging with the patient. This leads to frustration on both sides. The patient feels rushed or ignored, and both physician and patient question the quality of care.

Hands-free and headset-free technologies like Google’s Glass allow doctors to record notes and enter information into the patient’s EHR in real time without being tied to a screen. Speech recognition systems together with knowledge bases offer Computer-Assisted Physician Documentation (CAPD) software that allows for the dictation of notes while ensuring services are captured, coded and billed appropriately.

Freed from the burden of handwriting or typing notes, physicians are able to engage more fully with patients.

Another technology increasingly being used to improve practice workflow is real-time location systems (RTLS), used for tracking patients, staff, and medical equipment within a practice.

By capturing data such as patient wait times and flow, duration and location of patient and staff interactions, and equipment use, RTLS can identify utilization trends and identify bottlenecks in the workflow. Targeted actions can then be taken to optimize patient flow, improve staff utilization, and address other concerns that have caused patient complaints. RTLS can also reduce unnecessary expenditures.

Determining which technology best serves your patient demographic and your practice culture, together with privacy and security concerns and financial considerations, can make the decision to adopt digital technology difficult. But in an age of patient surveys and social media, your practice’s success may depend on it.

Joseph E. Guimera is an attorney and founder of Guimeralaw Cybersecurity Advisory where he helps organizations plan, build, and execute cybersecurity programs. He can be reached at 

Articles

The patient experience has become a top concern for practices as it affects physician online ratings, practice reputation, and patient acquisition and retention.

Digital technology and the patient experience

Digital transformation was supposed to revolutionize the healthcare industry by improving patient care and operations and reducing costs. To date, while digital transformation has led to positive changes, it has not radically changed services, processes, or business models. 

The focus thus far has been primarily a conversion of analog processes to electronic form: the increased use of mobile devices and the adoption of EHRs, cloud-based services, and applications. The result has been improvement in patient engagement, increased efficiencies and reduced costs in back-office functions, and greater ease in dealing with third-party providers. These steps have been promising, but nothing transformational. This is about to change. 

We are now at the early stages of a second phase of digital transformation that focuses on using technology to revolutionize the way patients are diagnosed, treated, and monitored and to deliver more timely, precise, and efficient care. The following are four examples of truly transformational technology:

Big data analytics - the computational analysis of data to uncover trends, patterns, and associations - can be used to reduce costs, track, and 

. Big data software can lower the rate of medication errors by alerting doctors and pharmacists to inconsistencies between a patient’s health and drug prescriptions. Analytics can also help a practice manage staffing more efficiently and streamline workflow.

In a broad sense, artificial intelligence (AI) makes it possible for machines to perform human-like tasks and learn and adapt from experience. The more data an AI application receives, the more accurate it becomes. The ability to gather, process, and act on information without human input eliminates routine tasks, improves efficiency, and minimizes risks. 

AI provides precise and accurate data that leads to better diagnoses, treatment plans, and patient outcomes across all practice specialties. In oncology, AI powered software can analyze thousands of pathology images of various cancers to deliver highly accurate diagnoses and predict the most effective anti-cancer drug combinations. Surgeons can use AI for real-time guidance to increase precision in removing tumors. Radiologists using AI can spot details that escape the human eye. Similarly, lab tests can be quickly analyzed for patterns of existing or missing data to predict easy to miss conditions.

On the administrative side, AI makes EHRs easier to navigate and automates routine processes associated with them. The use of chatbots to help patients with care plans and answer routine questions is increasing as well.

The Internet of Medical Things (IoMT) refers to medical devices, equipment, and software applications capable of collecting and exchanging data via the web. WiFi enabled devices link directly with cloud platforms for data storage and also communicate with similarly enabled devices. 

These devices, including wearables, implanted devices, infusion pumps, and more, can monitor, inform, and provide objective actual data to identify issues, and allow for earlier intervention before they become critical. The large amounts of real-time data they collect and generate about patients creates a more efficient healthcare system with more accessible, personalized, and proactive healthcare services for all, andalso provides data to help train AI. 

Diagnosis, treatment, and monitoring can be done remotely, reducing the need for routine office visits and checkups. Patients can spend more time at home, rather than in a hospital or doctor’s office, and doctors can spend more time with patients requiring critical care. 

While robots have long been a part of healthcare performing tasks, such as assisting a human surgeon or performing surgeries autonomously, their use in medicine has recently been expanding. Here are some examples:

As life expectancy has increased, robot companions are being used to interact with aging patients to help them remain independent and alleviate loneliness. 

Robotic nurses designed to perform repetitive tasks, such as taking vitals, monitoring a patient’s condition, restocking supplies,and drawing blood, free up human nurses to perform tasks requiring empathy and human decision skills. 

Several projects are working to develop microrobots that can travel through bodily fluids to precisely deliver medication or repair damaged cells. 

Other emerging technologies similarly provide vital tools for patient care. Virtual reality and augmented reality tools are helping Alzheimer’s and dementia patients retrieve memories; genomes are being sequenced faster, leading to better diagnoses and more accurate treatments; and 3D bioprinting is allowing doctors to look into the body more accurately than with any X-ray or scan. 

The potential of these digital technologies being harnessed is leading to the best available treatment at reduced costs. 

Joseph E. Guimera is an attorney and founder of Guimeralaw Cybersecurity Advisory where he helps organizations plan, build, and execute cybersecurity programs. He can be reached at 

Four types of technology that will revolutionize patient care.

Digital transformation in healthcare: Time to focus on the patient

Medical practices often ask, “Is our security program compliant?” While meant with the best of intentions, this is the wrong question to ask. The question practices should be asking is, “Is our security program operating effectively?” 

“Is our security program compliant?” evidences a compliance-focused mindset that provides a minimum level of security. 

Many medical practices base their cybersecurity program on government or industry frameworks, such as the Department of Commerce’s National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Department of Health and Human Services’ Health Industry Cybersecurity Practices (HICP), and the Health Information Trust Alliance (HITRUST) Framework. These frameworks provide cybersecurity best practices, templates, and other resources to create cybersecurity programs. 

The problem is that these frameworks are intended to apply to the broadest audience possible. They are non-customizable and apply to practices of every size, every medical specialty and subspecialty, and every configuration of technologies and software. The minimum baseline created by the framework may be sufficient for risk mitigation and compliance for some practices, but for many practices it will not be enough. 

Compliance to these frameworks, therefore, leads to a check-the-box approach that provides a low level of security but fails to adequately address actual threats to a practice.

Furthermore, frameworks are static documents that cannot keep up with the constantly changing threat landscape. Identifying a new threat, evaluating it against the framework, and revising the framework to address the threat all take time. During this time practices adhering to the framework are unprotected from the threat. 

Compliance-based efforts are blind to the specific business needs, potential risks, and security objectives of a practice. Taking actions merely to ensure that minimum requirements of a framework are met can lead to spending resources unnecessarily while still leaving a practice at risk.

“Is our security program operating effectively?” promotes a risk-conscious, security-aware approach that allows a practice to customize cybersecurity efforts to ensure that measures taken are optimized and cost-effective. Risk management becomes the primary focus of the cybersecurity process, and specific security measures become secondary.

This approach recognizes that not all risks are the same. The consequences of some risks are so low they can be ignored, while the consequences of other risks are so severe they must be avoided at all costs. Adopting this approach requires a practice to identify each risk, analyze the likelihood and consequence of each risk with and without an appropriate security measure, and evaluate whether the risk is acceptable or serious enough to warrant adopting a security measure. A risk-aware approach does not eliminate the consideration of compliance, but merely treats it as another risk. 

By focusing on risk management practice leaders can evaluate the risks associated with their infrastructure and data assets, identify the acceptable levels of risk, and pinpoint the resources available or necessary to minimize risk. It is a more encompassing view that addresses a practice’s unique risks, threats, vulnerabilities, risk tolerance, and existing and proposed security measures. It also takes into account the human element of cybersecurity since a risk-based approach must involve  personnel from all areas of a practice and account for their strengths and weaknesses.

Practices with this approach have a dynamic cybersecurity program that can evolve quickly with changes to a practice’s goals and objectives, patient care, industry, technology, the threat landscape, and laws and regulations.  

In the event of a breach, a risk-aware approach offers an additional benefit over a compliance-based approach. One question arising following a breach is whether the breached party met its due diligence obligation (based on industry-accepted norms or standards of care) to take appropriate actions to protect against the breach. But those norms and standard are not always clear. For cybersecurity, they may vary from industry to industry, or in the case of medical practices, from subspecialty to subspecialty. In some situations, the standard of care may not even align with industry norms. Documenting that a risk management plan was carefully considered and adopted may go further in meeting the due diligence standard than a compliance-based approach. 

“Is our security program compliant?” or “Is our security program operating effectively?” One question will lead toward creating a robust set of cybersecurity controls designed to meet the specific business needs of your practice. The other will lead to adopting a one-size-fits-some regulatory or industry framework. 

If you are concerned that your security program is non-compliant, you should be-because you're worried about the wrong issue. 

A risk-aware approach to cybersecurity

Cloud computing is transforming the way medical practices serve their patients. Offering lower operational expense, increased scalability and flexibility, and remote access to applications and data anytime from anywhere, cloud technologies allow a practice to implement better ways of working and offer new services to patients. However, adopting cloud technology raises significant and often-overlooked cybersecurity and data privacy risks.

Cloud computing gives practices a cost-effective way to leverage shared, on-demand computing resources that might otherwise prove cost-prohibitive to deploy and maintain. These resources can include networks, servers, storage, applications, and other services. Users pay a subscription fee to access and use a cloud provider’s resources, ranging from fully-developed software solutions (Software-as-a-Service, or SaaS) to a framework to deploy custom applications (Platform-as-a-Service, or PaaS) to full control of servers and storage (Infrastructure-as-a-Service, or IaaS). These options can significantly reduce the cost and time required to build out such a system and eliminate the need for physical server storage and maintenance. Some subscriptions will also include technical support in the event a problem arises. 

Three deployment models-private cloud, public cloud, and hybrid cloud- describe how resources are distributed and accessed. A private cloud has a single user. A public cloud has multiple users, each paying according to the services purchased and their usage. A hybrid cloud is a combination of the public and private models, generally with non-critical functions hosted in a public cloud, and sensitive information held in a private cloud. Most healthcare providers use a hybrid cloud to balance security and costs. 

Each service type and deployment model requires the user to transfer control of information and system components to the cloud provider. The provider handles application upgrades and maintenance, and data and applications are hosted on servers owned or leased by the cloud provider. This leaves the user with little or no control of where or how their data is moved, processed, or stored, raising concerns about the integrity of the provider’s systems, unauthorized access to data and systems, and availability of service. Cloud providers are themselves subject to data breaches, denial of service attacks, malware, and insider attacks. 

The HIPAA and HITECH laws require patient data to be properly protected, no matter where it is stored. Ultimate responsibility for protecting and securing the data remains with the healthcare cloud user (i.e., the medical practice). All practices using cloud technologies should use a HIPAA-compliant cloud provider willing to enter into a business service agreement detailing the use, disclosure, and safeguarding of patient data. But relying on HIPAA compliance is not enough. HIPAA is concerned with protecting the confidentiality, integrity, and availability of patient data, not with deterring cyberattacks. 

Medical practices need to proactively protect their data, applications, and systems-they cannot rely solely on the cloud provider. The cloud provider may provide a secure service, but it is up to the user to ensure that services are configured correctly and that they are being accessed appropriately through secure connections with careful limitations on who can access the data. Practices also need to maintain their in-house network security and install antivirus and anti-malware software, install firewalls, regularly update and patch programs and software, encrypt data, restrict access to network and cloud services, manage use of mobile devices, and properly train staff to ensure the integrity of their cloud services. 

Additionally, practices should conduct a thorough investigation of the cloud provider’s security policies and procedures. The provider’s security policies should be as strong as, or stronger than, those of the practice. Determine whether the provider has suffered any data breaches in the past, and if so, how they responded to the breach. 

Practices should negotiate a cloud service agreement specifying the scope of services provided and the specific responsibilities of the parties. The agreement should contain detailed provisions regarding security and privacy, such as moving, handling, and storage of data (Will data be stored on a dedicated server or a server shared with other practices?); data access and use (What forms of user authentication and authorization will be used?); data retention and disclosure limitations; insurance and indemnification; system availability and reliability; back-up and data recovery; return of data after termination of service use; threat and risk analysis; and disclosure and breach reporting requirements. The agreement should also provide procedures for periodically auditing and verifying compliance. 

The cloud offers exciting new opportunities for medical practices that leverage it strategically and safely. Cloud computing creates new security risks, but when practices understand those risks and work proactively to mitigate them, the cloud can provide a world of benefit while still reducing costs. 

The cloud offers exciting new opportunities for medical practices that leverage it strategically and safely.

Taking your medical practice to the cloud: What you need to know 

Continuing cyberattacks on healthcare providers emphasize the need for medical practices of all sizes to make cybersecurity an essential part of their business. Here are seven steps to strengthen your practice’s cybersecurity position. 

Successful cybersecurity begins with understanding the actual threats and vulnerabilities your practice faces. A cybersecurity risk assessment lists the practice assets that could be subject to cyberattack (such as hardware, systems, mobile devices, patient data, etc.), identifies the possible threats to those assets, and evaluates the likelihood of the identified threats actually occurring. This allows you to focus resources on the risks most likely to occur and prioritize which vulnerabilities to address first. 

A risk assessment also is important in the event of a data breach. It shows you acted reasonably in identifying and addressing potential threats and may be required to obtain cybersecurity insurance.

Unprotected systems and outdated programs and software are frequent points of attacks for cybercriminals. To safeguard your systems:

Install antivirus and anti-malware software to scan email attachments for viruses and your system for malware.  

Install a firewall to protect your network by monitoring and controlling the incoming and outgoing data streams.

Regularly update your programs and software. Promptly install all software updates since these often contain security patches addressing vulnerabilities discovered since the last update.  

Encrypt your data. Several readily available programs allow you to encrypt a select group of files, or for a more secure option, your entire hard drive.

Regularly back up your data to a secure cloud platform, an external hard drive, or to both. Backups will enable you to recover your data in the event it is damaged, lost, stolen, or held hostage with ransomware.

Not every staff member needs, or should have, access to all of your practice’s data. Staff should have access only to data they need to properly perform their job functions. Determine access and privileges by following a three-tiered data classification system which restricts access according to data sensitivity.

Public data is non-sensitive data that poses no risk to the practice or patients, requires minimal security, and may be accessed by all staff. Private data is moderately sensitive data that poses a relatively low risk, but should be handled guardedly with limited staff access. Sensitive data is data that if compromised could cause severe damage and requires a high level of security. Access to sensitive data should be permitted only on a need-to-know basis.  

All data should be accessible only with user authentication to verify the person accessing the data, and audit logs should be created to monitor access. 

Many practices allow employees to bring their personal mobile devices to use at work (bring your own device, or BYOD). While BYOD is convenient, it also raises security issues, as personal devices can have outdated operating systems, lack minimal security controls such as password protection or encryption, and may be easily lost or stolen. 

Adopting a well-defined BYOD policy helps lessen the security risks. A BYOD policy should address which devices may be used on your network and require the use of passwords or biometric authentication, regular updates of the operating system and installed apps, installation of anti-malware and antivirus software, and a remote wiping program to delete data in the event the device is lost or stolen. 

Your staff can be either your best defense against cyberthreats or your greatest weakness. The most sophisticated technology won’t protect against a staff member inadvertently opening a phishing email, inserting a malware-loaded USB drive into a computer, losing a mobile device, or connecting to an unsafe wi-fi network-all risks that can be mitigated through security awareness training. 

An effective security awareness program should teach all staff to understand the threats and vulnerabilities to the practice (phishing, social engineering, lost or stolen mobile devices, outdated software, etc.) and their responsibilities in defending against these threats and vulnerabilities. Broad advice such as “use strong passwords” or “don’t open phishing emails” is meaningless. A more effective approach is to teach staff how to create stronger passwords, how to spot a phishing email, and how to integrate cybersecurity best practices into everyday use. Empower your staff to take an active role in the practice’s cybersecurity. Provide periodic instruction to reinforce prior learning and enable staff to keep up with constantly changing and evolving cybersecurity threats.

Several of the biggest security breaches in recent years originated with third party vendors. Mitigate your third-party risk by adopting a policy that limits vendor access to your data and network. As with staff, vendors should be able to access only the data and portions of your network necessary to perform their duties. 

In addition, frequently assess your vendors’ security practices. Ask vendors whether they employ security controls, provide cybersecurity training for their employees, and regularly patch and update their software and vulnerability protection. A vendor’s security practices should be no less diligent than yours. 

Despite best efforts, breaches will occur. Identifying, responding to, and containing a breach quickly can significantly reduce the cost and impact of a breach. An incident response plan (IRP) establishes a framework for detecting, acting upon, and limiting the effects of a data security breach. An IRP typically addresses who within an organization is responsible for investigating a security incident, what resources (technical, forensic, legal, public relations, etc.) are available, and enumerates the incident assessment, countermeasures, and corrective and notification actions to be taken. 

Cybersecurity is a real and serious issue, but taking the above steps can drastically lower your practice’s exposure to a cyberattack. Remain vigilant about your cybersecurity position as you would your practice’s physical security, and you will be much more likely to avoid a breach and the resulting costs and damage to your reputation. 

 is an attorney and founder of Guimeralaw Cybersecurity Advisory where he helps organizations plan, build, and execute cybersecurity programs. He can be reached at 

Cybersecurity is a real and serious issue, but taking these seven steps can drastically lower your practice’s exposure to a cyberattack.