Nelson Gomes

As we approach the end of 2016, it is important to prepare for technology challenges your practice may face and opportunities you may want to capitalize on in the new year.

Here are eight developments in healthcare technology to know about for 2017:

While we do not know how the new presidency will affect federal healthcare regulations, one can safely assume that security and compliance will remain an area of focus. This past March, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) launched its second phase of HIPAA audits of covered entities and their business associates. In October, OCR released new guidance on HIPAA and cloud computing. These and other recent developments indicate security and compliance are under close scrutiny. Practices should take compliance seriously.

They should also take the threat of cybercrime seriously. Cybercriminals are increasingly targeting healthcare providers because of the black market value of medical records and use of outdated security measures. Symantec's "

" noted that the largest number of data breaches in 2015 took place within health services, comprising 39 percent of all breaches last year. Ransomware - when cybercriminals use encryption to hold companies’ and individuals’ data hostage - increased 35 percent percent in 2015. There is no reason to believe cybercriminals will stop targeting providers.

Informatics has been a buzzword for quite some time. What are its benefits informatics? While it's a few years old, the University of Illinois at Chicago spells this out in a detailed 

. Key takeaways include dramatic reductions in malpractice claims after introducing EHRs, faster lab results when using EHRs, potential for significant cost savings, and improved quality of care.

Along with informatics, analytics remains in the spotlight thanks to its potential to deliver significant improvements in all aspects of a practice's operations by converting big data into actionable insights. Practices can expect to see more informatics and analytics solutions hit the market in 2017. It will be important to conduct due diligence before investing in an informatics and/or analytics solution.

Mobile health (mHealth) is showing no signs of slowing down. A 

Pricewater Cooper Health Research Institute (PwC) survey

 revealed some insightful statistics about the use of mobile devices, including the following:

• Sixteen percent of consumers used at least one medical, healthcare or fitness app in 2013. That number doubled to 32 percent in 2015.

• 60 percent of consumers are willing to have a video visit with a physician through a mobile device (more on this later)

• 81 percent of clinicians say mobile access to medical information helps coordinate patient care

• 38 percent of clinicians use email to stay connected with their chronic disease patients.

It will not be surprising if all of these figures increase in 2016. Practices will want to examine how they can use mHealth to boost patient engagement and satisfaction to improve care delivery and help achieve a competitive edge over slower adopting providers.

How do you grow patient volume without increasing foot traffic to your practice? Telemedicine. It's already on the radar of many providers, with the PwC survey indicating that 58 percent of clinicians would rather provide a portion of care virtually. Insurance companies are getting on board with covering telemedicine, and an increasing number of states have laws concerning its coverage. As previously stated, a growing number of consumers are willing to consider video visits with a physicians. It's up to practices to meet these consumers in the middle.

Already, there are technologies used by patients that capture vital signs, blood pressure, heart rate and more that then transmit the data to healthcare facilities. Practices can expect the number and types of these devices to grow in 2017, and patients to become more accepting of them, especially as an alternative to physically visiting a practice.

For the past few years, there has been an effort on behalf of government agencies to move toward increased interoperability of health IT systems.

 (Cures) shows the government's intention to make interoperability a high priority in the coming years. As the U.S. House of Representatives Committee on Energy and Commerce 

, "The development of new drugs and devices is meaningless unless they are delivered to the right patients at the right time. Cures will help improve delivery by: ensuring electronic health record systems are interoperable for seamless patient care and help fully realize the benefits of a learning health care system."

A contributor to Apple's success is the tendency for users of Apple products to own multiple Apple products. One reason for this brand loyalty is that Apple products are integrated systems.

It is for this reason that practices can expect a greater push for integrated systems in the market in areas such as access control, video surveillance and audio/visual equipment. When these devices are integrated, implementation, management, upgrades, data retrieval and training is easier.

With a growing emphasis in healthcare on streamlining operations, technology companies are working to meet this objective and secure more of an organization's business at the same time.

No discussion about technology trends of the past several years and likely the next several years would be complete without at least mentioning the cloud. As practices and other healthcare providers implement a greater number of robust systems, the need for convenient, secure data access and retrieval will grow.

Practices should expect technology vendors to encourage greater use of cloud computing. It is important to remember that if a practice shifts any of its data storage to the cloud, use of the service must comply with HIPAA.

Articles

Practices need to focus their tech brain trust on potential developments in security compliance, mobile and more, in the coming year. 

8 Health Tech Challenges and Opportunities in 2017

" and noted that healthcare data breaches were most likely to be caused by human error. In its analysis of 2015 breaches, Verizon identified the following as significant contributors:

• Lost and stolen assets, such as laptops and smartphones;

• Sending sensitive information to the wrong person;

• Use of weak, default or stolen passwords; and

• Opening malicious attachments or nefarious links in an email.

In a press release, the executive director of global security services for Verizon Enterprise Solutions, said, "You might say our findings boil down to one common theme - the human element."

While your staff members are likely your practice's top source of vulnerability when it comes to your falling victim to a cyberattack or data breach, they also represent your first line of defense. That's why it's critical to make data security a priority for your practice, if it's not already. To do so requires development of an IT security training program that keeps data security high on your staff's list of responsibilities.

Here are eight steps to take to develop and support an effective IT security training program.

This vital step in planning your training will specify what you want your staff to learn and reduce the likelihood of omitting critical information to cover during training. Outline the specific aspects of IT security your staff needs to learn to be smart, compliant users of technology. These goals will serve as a framework to create your training and help identify different mediums you will use to deliver training.

To develop an effective training program will require substantial work up front. Executing and maintaining the program will require ongoing work. Leadership must be educated on the importance of IT security training and support efforts in this area. Poor support could lead to a lack or reallocation of resources, which is likely to contribute to an incomplete program that leaves a practice more vulnerable to security threats.

You likely have some components of IT security already in place at your practice, such as assigning passwords to access computers and the use of anti-virus software. Perform a risk assessment to identify where security gaps exist, which should include analysis of any IT training you provide and opportunities for improvement.

4. Understand staff roles and their vulnerabilities. 

Depending upon how your staff members' IT privileges and roles are established, they likely can access some programs used by your practice, and may have restrictions on their ability to access other programs. It is important to understand which of your staff members can access your programs, define their roles in using these programs and then identify associated vulnerabilities. For example, if a staff member with access to the EHR has his account breached, it could lead to theft of protected health information. Your training program should include guidance specifically related to staff roles and vulnerabilities.

5. Deliver education on security policies and procedures.

 It's not enough to just have security policies and procedures. Staff members need to receive education on your policies and procedures when they start working at your practice. They should also receive re-education as part of annual training and whenever policies or procedures undergo changes. Also consider including IT discussions during all staff meetings. This will help keep security at the front of staff members' minds.

Within your training, it's important to teach staff what to do and not to do. Hit home the importance of following these rules by including discussion of the ramifications of their failure to follow instructions, such as the penalties associated with HIPAA violations.

It's great to have IT "superusers" at your practice - staff members with the most knowledge about your programs and technology, and people that other staff can approach with questions. But one potential downside of superusers is a practice that relies heavily on these individual(s) is often left scrambling to replace knowledge lost when superusers leave a practice. Help overcome this obstacle by making cross-training part of your training program. Cross-training can help develop more superusers, or at least more knowledgeable technology users. This will reduce the likelihood of IT-related errors and make a practice less vulnerable if employment of a superuser ends.

Cybercriminals work around the clock to find new ways to breach IT systems and steal data. Practices must stay abreast of new threats and the processes that keep technology and data safe and secure. As you come across news and resources on IT security, share the information with your staff (via email, newsletter, bulletin board, etc.), and then discuss the most significant developments during staff meetings.

The more informed you are about cybersecurity, the better prepared your practice will be to protect itself from threats and respond effectively and appropriately to cyberattacks.

Nelson Gomes is the president and CEO of PriorityOne Group, a New Jersey-based healthcare IT consulting firm. Gomes has more than 25 years experience in IT, including 20 specifically in health IT, providing services to medical practices, ambulatory surgery centers, and clinics.

Avoid having problems with data protection. Here are eight steps to take to develop and support an effective IT security training program. 

8 Steps to Developing a Health IT Security Training Program

The year is almost over, so it's time to start planning for 2015 (if you haven't already). This should include planning your practice's budget, including important factors such as payroll, equipment, and any capital projects coming up, but it must also include IT expenses.

To get a general idea of what you can expect to spend on IT in 2015, analyze your expenses for 2014. Understand that this is just an estimate, and likely a rough one at that. As with the other areas of your budget, IT expenses are rarely consistent each year, and may even be significantly different from one year to the next depending upon whether your practice undergoes any substantial changes.

Here are eight areas of focus when putting together your IT budget.


2014 was a year of significant HIPAA developments. There were several high-profile data breaches, both in healthcare settings and businesses in other sectors (e.g., Home Depot, Sony). An individual healthcare record is now worth more on the black market than a U.S.-based credit card and personal identity with social security number combined, according to 

, making healthcare data even more appealing to hackers. In April, Microsoft ceased providing automatic fixes, updates or online technical assistance for Windows XP and Office 2003, leaving them both vulnerable to security issues. It's now been more than a year since the HIPAA Omnibus Final Rule went into effect.

Regulators are more aggressively pursuing audits. It is critical for providers to conduct at least annual HIPAA and HITECH security risk analysis and remediation to help ensure protected health information (PHI) is secure. Practices should budget for this accordingly.


As with Windows XP and Office 2003 in 2014, Microsoft is ending support of Windows Server 2003 on July 14, 2015. As of that date, Windows 2003 will be considered vulnerable to security issues, and a practice using it for anything involving PHI will be technically out of compliance with HIPAA.

Practices need to identify whether they have machines using this operating system, and then determine which machines have hardware capable of running a newer operating system and which do not. For those that can, practices should budget for a license upgrade plus the fee to configure the computer for its use. For any machines that cannot, they will have to either be replaced or have their technology inside upgraded.

3. Disaster recovery and business continuity


Practices rely heavily on technology to power their operations. So when an IT disaster occurs, which can be at any time, it can very easily have a substantial, negative impact on finances and operations. Your practice will likely experience at least a small IT disaster every few years, but nearly 

one in five businesses suffers a major disruption to its data or voice networks or communications systems every year

It is critical that practices have a comprehensive, HIPAA-compliant IT disaster recovery and business continuity plan. Such a plan should detail not only the steps a practice will take to recover from any type of IT disaster, but also how to maintain business continuity during and after a disaster to help limit the short- and long-term effects.

If you do not already have such a plan in place, it is important to invest in its development - and complete development as soon as possible. If your practice has a plan, it should be tested in 2015, so budget for this accordingly. If there are changes made to IT systems next year that will affect the plan, it will need to be updated and should be retested in order to help ensure a seamless business continuity strategy in the case of catastrophic event.


If you have plans to grow your practice next year, you'll want to take into consideration the IT costs associated with the changes. Moving into a larger building or adding locations? Expect a significant investment in IT. Even just adding physicians or new staff can incur IT-related expenses that quickly add up, as you will need to take into consideration new computers and workstations, software licenses, and telecommunications (voice and data services).


If 2015 will be the year when you take the plunge and add an EHR or another significant electronic system to your operation, it's important to determine not only how much the system itself will cost but also associated costs, including installation, hardware needed to run the system, licenses for users, and training. Always give your IT point person plenty of notice if you intend to invest in a new system to allow ample time for research and planning.


Some of the software your practice may use, including an EHR and practice management software, have maintenance costs associated with them. Maintenance for these mission-critical solutions typically run between 17 percent and 23 percent of the original licensing cost for the software; not pocket change if a system costs $100,000.

Ask these system vendors if any significant upgrades are planned for 2015. If so, you need to determine whether your existing hardware can support such upgrades.


It's likely that at least one of your IT-related contracts will be up for renewal in 2015. Such contracts can include IT managed services agreement, telecommunications, and phone system. Use the end of this year as an opportunity to review all of your contracts and note those up for renewal next year. Try to determine well in advance whether you need to make a change to the contract (such as number of computers and users accessing a service) or intend to change service providers, and how such a change will affect the rate you pay for these services. It's a good time to research options to see if there are worthwhile alternatives available, and whether you can leverage other options as part of contract negotiations.


As with contracts, it's likely that some of the warranties on your practice's major IT equipment, such as servers, switches, and firewalls, will expire in 2015. You should determine whether this will be the case for your practice, both for initial and renewed warranties, and determine whether it's worthwhile to renew the warranty, if you have the option. Take into consideration the age of the equipment, and whether you're better off simply replacing the equipment.

It's time to start budget planning for 2015 and that should include IT expenses. Here are eight areas of focus for your medical practice.

Your 2015 Medical Practice IT Budget: 8 Areas of Focus

Under the HIPAA Omnibus Final Rule published last January, the deadline for compliance with the new HIPAA rules was essentially Sept. 23, 2013. However, there was an exception built in to the rule for physician practices and other covered entities (CEs). This exception stated that for CEs with vendor business associate agreements (BAAs) entered on or before Jan. 25, 2013, these BAAs must be brought into compliance with the Omnibus Rule by Sept. 23, 2014.

Failure to ensure your BAAs are HIPAA compliant can lead to penalties that can devastate a medical practice financially and ruin its reputation if protected health information (PHI) is stolen.

If you have missed the Sept. 23 deadline, by the letter of the law you are out of compliance. The chance of your being audited on that is slim, and there's probably no need to panic. With that said, do not drag your feet. Pull your program together as soon as possible. By all accounts, the Office for Civil Rights is going to be increasing enforcement audits come Jan. 1, 2015, and you should be prepared.

Here are three steps practices should take to comply with the requirements of this final Omnibus Rule deadline.

A helpful tip on how to identify your practice's business associates: Pull up accounts payable to access your list of vendors. With this list in front of you, identify vendors that have access to your PHI. These vendors may include IT companies, transcription companies, coding and billing companies, consultants, collection agencies, and shredding companies.

 Under the Omnibus Rule, the definition of business associated was reworded. A business associate now includes any vendor that creates, receives, maintains, or transmits PHI on behalf of a CE - even those that do not access PHI. Business associates can now include organizations involved in patient safety activities, health information organizations, and PHI data storage companies.

Once you have identified which vendors qualify as business associates, you should review the latest BAA they signed with your practice. If the most current BAA you have on file with a vendor is signed on or before Jan. 25, 2013, you should immediately amend or replace this BAA and have a vendor sign a new BAA that complies with Omnibus Rule requirements.

If your practice delegates duties to a vendor, a practice has a responsibility to confirm - to the best of its ability - the business is handling those duties in conformity with HIPAA rules. This can be accomplished through an auditing process in which your practice asks business associate representatives a number of questions and then assesses the answers. These questions include the following:

• Do you have updated policies, procedures, and manuals that your organization follows to show compliance with HIPAA?

• Have you trained all of your employees on the privacy and security procedures covered by HIPAA and documented the training?

• Do you have a mechanism in place to train new employees and document the training?

• Have you recently (certainly within the last year) completed a security risk assessment and documented this assessment?

• Do you have mechanisms in place to ensure you remain compliant with HIPAA?

• Do you have mechanisms in place to ensure any subcontractors that will have access to PHI agree to the same restrictions, conditions and requirements that apply to the business associate with respect to such information?

Business associates held to high standards

With the passing of the Omnibus Rule, business associates can now be held directly liable for HIPAA breaches and violations. As a result, business associates are now required to establish and maintain a similarly comprehensive HIPAA program as CEs.

When your practice is auditing its business associates, this is the type of program you're looking for. If the audit reveals anything concerning regarding a business associate's ability to comply with HIPAA rules, request the business associate address the concern immediately or consider replacing this vendor.

While business associates can now be held directly liable for their improper use or disclosure of PHI, if a business associate is found to be negligent (or worse) in the handling of PHI, a CE can still be found liable. A well-drafted BAA can go a long way in protecting a CE from any improper actions by its vendors.

esource for outsourced accreditation and healthcare compliance solutions. E-mail him

Your practice's business associates can lead to HIPAA issues. Here are three tips to ensure your vendors can ensure the safety of protected health information.

Author | Nelson Gomes

Articles

8 Health Tech Challenges and Opportunities in 2017

8 Steps to Developing a Health IT Security Training Program

Your 2015 Medical Practice IT Budget: 8 Areas of Focus

Updating HIPAA Business Associate Agreements: 3 Steps