Stephen McCallister, CPHIT

The only constants in healthcare these days appear to be change and uncertainty.  Additionally, with technology at the heart of workflow in most practices, your wagon is  hitched to the dizzying pace of technological change.  Just consider that devices such as smart watches and tablets didn't exist a decade ago, and the flood of apps and connected devices are remaking medicine as much as everyday life. At best, this level of change makes strategic planning difficult. At worst, it can make strategic planning seem pointless. 

However formal or informal your strategic planning process, information technology should have a voice in it.  For one thing, IT in healthcare has been a rapidly growing part of most practices' budget.  IT is also disruptive, changing both the daily workflow and offering potent innovations for healthcare overall.  Therefore, it's important to integrate IT in your planning. This is not to predict the future, but rather to help you 

A large organization will likely have a technology strategic plan, a document which is related to, but separate from the organization's strategic plan.  This accommodates additional detail, but it also has a potential for disengaging the integration of technology from the overall business strategy.  This risks crafting goals focused on technology, rather than how technology can provide value for the organization's priorities.  

Ironically, one of the "luxuries" of a small- to medium-sized practice is that it's easier to assemble an integrated team, which can be more effective in developing a strategic plan for the practice.  You may not have the resources - or many of the problems - of a large practice or hospital.  However, having a representative group of stakeholders working on an integrated strategy is easier in a small to medium-sized practice.  

Here are a few tips and pitfalls to get you started:

: Strategic planning is about the direction and goals that will help your practice move forward.  No one person will have all the answers.  Indeed, the "answers" will have the best chance to emerge through dialog among those with varying perspectives and expertise in your practice, including technology.  Be sure to craft a process that makes choices and sets clear priorities, not just compiling a list of what everyone was going to do next year anyway.    

 In the best of all worlds, you have an IT person or department who knows the practice and can be a great resource on how to leverage your technology investment for potential solutions to your most challenging problems.  A broad knowledge of the IT industry is likely to yield technical solutions you may not be aware of.  If you don't have that kind of expertise, then seek the advice of a consultant or other subject matter expert who can work with your team.

  Ask your technology subject matter expert to provide input and data to your planning process, assessing both internal and external factors.  A tool such as a SWOT analysis can be useful to identify information from IT on the external environment, including both technological trends and opportunities.  Incorporating information such as your most recent HIPAA Security Risk Analysis will give an accurate assessment of both internal strengths and weaknesses.   

 Your IT expert can provide data that goes beyond what's in your monthly financials and reports.  Ask for it. Unlock the data in your EHR, practice management system, and other sources to help you in your strategy selection.  And be sure to note if you can't get the data you need - that in and of itself may be a valuable planning insight.

 Chase business needs and value.  Avoid "Shiny Object Syndrome." This should go without saying, but in the real world, you'll likely need to remind yourself of this regularly.  Telemedicine, for example, is a sexy technology, but that doesn't make it a priority.  Using telemedicine to mitigate rural provider shortages and increase access for patients IS a reason to consider making it a strategic priority. 

 Look for technological solutions that match your practice's management style, whether you embrace the bleeding edge or are looking for proven, "ready to run" technologies.  Look not only about technology, but also about the skills and culture in your practice. 

Don’t forget your people in the process:

 If you ask most clinicians about your EHR and IT systems, you may hear a lot of dissatisfaction.  After all, the name of the game with technology is change - and as we all know, change is hard.  Something as simple as a survey using a tool like Survey Monkey can surface this and help to ensure that these issues aren't papered over.  But the bottom line here is that implementing your plan will inevitably involve people and technology, to succeed you will need to include both.

Finally, integrating IT is a great way to educate your IT staff about your practice.  In a world where people too often work in their own silos, that alone can be a huge asset.

Articles

Strategically planning IT investment and implementation is important for any small-to-mid-sized practice. 

Integrating Technology in a Practice's Strategic Plan in 7 Steps

Several years ago, I asked an ophthalmologist how he liked using his practice's EHR.  His response: "I don't really like it, but I'm glad everyone else uses it."  His faint praise was telling  and I suspect it's been echoed thousands of times since.  There are some truly great things about an EHR's anywhere / any time access to health records.  But the process of working with healthcare information technology often remains painful, especially when it comes to getting information into and out of your EHR. 

Optimizing your EHR and other IT systems isn't a "one and done" activity.  Doing a work flow analysis is a keystone of most guides to EHR implementation. Of course, over time your work flow changes and new requirements emerge.  And your familiarity with and knowledge of the capabilities of your tech tools improve after you've used them for a while.  And the technology itself changes over time, creating new possibilities to improve your practice's efficiency.  Periodically reassessing workflow is vital to maintaining your efficiency.

If you want to get started on optimizing your EHR, begin by talking with the people who use it on a daily basis, both providers and support staff. Converse with and observe your staff in their use of your systems.  They'll be able to tell you what isn't working well - and maybe even what they like, too.  Observing and documenting work flow can point out inefficiencies, both on-screen and off the screen. 

But don't stop with your internal discussions.  Remember: you don't know what you don't know.  Your EHR vendor may offer "EHR optimization" visits, which can alert you to features you've not implemented, as well as new capabilities for interfacing to other systems and equipment.  And don't forget to talk your peers in other practices using the software.  They may have real-world feedback on which features work well and are worth the cost, as well as what doesn't live up to the hype.    

Here are some themes that often emerge from examining tech work flow that you'll want to keep in mind:

:  It's very common for staff to want to preserve old work flows, usually to mimic a prior system (whether paper or electronic.)  While change is hard, preserving the status quo can blind you to better ways to do things.  This is one area where a fresh set of eyes from a consultant or even your EHR vendor can help you see beyond just duplicating your comfortable routine. 

• Don't accept, "but, we tried that already…"on its face

:  Sci-fi author William Gibson said, "The future is already here - it's just not evenly distributed."  Many people scoffed at the usefulness of a camera on a smartphone some years ago.  Today, the same people might be using that smartphone to access care via telemedicine video! 

: Most of us don't have offices which were originally designed for today's technology.  Devices like large monitors, keyboards and mice, scanners, label printers, and signature pads all have to fit into reception areas not designed for efficient use of technology.  But the costs from ergonomic injuries and the inefficiencies of poorly placed devices can easily justify redesign of these areas to accommodate your technology. 

: Paper records were very forgiving, allowing everyone to pretty much have it their way - you could literally draw outside the lines.  EHR's today largely operate on the basis of structured data, so a lack of standardization in clinical documentation will blunt its capabilities.  If your vendor did initial EHR training, it's very common to emphasize the many different ways to do something in the software.  You should, instead, explore those possibilities - and then train staff to 

: While becoming less common, paper and faxing are major productivity killers.  Scanning documents into your EHR can be useful, but the result is just an image and the data can't be "read" or used by the EHR itself.  Interfaces and APIs (application programming interfaces) can move data from outside sources into your systems, with the full ability to analyze and use the data.  Self-service features such as patient portals are antidotes for the manual keying in of paper intake forms, and wrangling interruptions from phone call prescription refills and appointment requests. 

: Once you've determined how to optimize your work flow, use it as a basis for training all staff.  In small-to-medium-sized practices the temptation may be to just do "on the job" training, but that will rarely be as consistent as training to a specific workflow.  Additionally, codifying these best practices in training will ultimately ease the pain of staff turnover.

The bottom line here is that the use of technology in your practice should evolve, just as the technology itself does.  In order to get the best return on investment for your technology, you need to continuously improve your tech processes, just like any other aspect of your practice.

Here are six common themes that often emerge when practices examine their tech work flows. 

Tuning Your Health Technology Work Flow

As the saying goes, no one is irreplaceable.  But some staff may leave you feeling like you're over a barrel -and you might be.  This can be the case with IT people, particularly in small-to-medium practices where fewer staff mean more reliance on specialized roles, such as IT Manager. This can't be easily covered by other employees.  In other practices, the "IT Person" may be a vendor who provides computer and/or network services, but I'll just use "IT person" understanding that person may or may not be an employee.    

The other, mostly unsaid, thing is that the IT person, particularly in a small-to-medium practice, may hold the keys (i.e., passwords) to all sorts of systems vital to your practice's operation.  A practice manager may be concerned that the IT person may be snooping in their files or even reading their email.  You may even be afraid that the IT person would withhold information or even seek revenge if fired. 

Why do practices lose their IT person?  Sometimes they flame out after some spectacular failure or loss of data / systems.  Stereotypically, it may be that your IT person is better able to relate to computers than the people who need her help.  Often, it's for the same reasons other employees fail, ranging from basic incompetence, not providing good customer service, an inability to work productively with others, or dishonest or unethical behavior.  But there are other reasons, too.

Increasingly common is a skills mismatch or the IT person isn't able or willing to learn and adapt to changes in the practice's business or technology.  IT is undergoing a massive shift -from on-premises servers and applications to the cloud.  When the exchange email server moves to the cloud and the practice management and EHR systems aren't on in-house servers, this is a change in the daily life of your IT person.  Similarly, staff who have worked for years with a current application such as a practice management or EHR platform may be resistant to a change to, for example, a cloud-based alternative. 

Several times in my professional life, I've been asked to help evaluate a struggling IT person or department in a practice.  This often comes as the practice faces a major transition such as a change in leadership or philosophy.  From the IT person's perspective, there may be frustration that technology is not adequately funded or that a management decision to pursue (or not) a technology project ignores their advice or concerns.  From the practice manager's perspective, the problem may be that the IT person is more concerned with technology in and of itself, rather than what technology can do for the practice.  In my experience, by the time I get involved, practice management and IT are just talking past each other, never connecting or satisfying either party. 

Having said all that, here are some key considerations if you're thinking of letting go of your IT person.

1. If you don't trust that your email or voicemail are private, by all means use an alternative such as Gmail or your personal cellphone.  But be mindful that if the termination is contested, you may need to produce records of communication such as email, so keep ALL communication focused and professional.

2. Put in place HR policies that support ethics that IT protects privacy and confidentiality, including but going beyond HIPAA's standard of staff accessing protected information only on the basis of "need to know."  If you wonder what this might look like, the AHIMA code of ethics is a great start, even though it may look like more than you need: 

http://bok.ahima.org/doc?oid=105098#.WV0sQYgrI55

3. Understand that there will be costs to ensure that this process doesn't cause your practice to grind to a halt.  Get help beforehand: an outside IT consultant or vendor's expert assessment not only will tell you the state of your IT functions, but also identify risks.  Additionally, it also may support your case for termination.  As important, the consultant may be able to help you in the interim following the termination. 

4. HR and legal counsel will also be essential in understanding your options.  While they will help in ensuring that you have your "ducks in a row," they also may be also helpful in identifying other potential options (e.g., a skills mismatch may be resolved by a reorganization or lay-off.)

5. Don't do it in anger.  Anger may provoke a similar response, and you don't want to trigger rash action or revenge by your own actions.  Also, you very likely may be asked to account for your reasoning for the termination and, "because I was PO'd..." is never a good look in court.

6. Follow a structured process for the actual termination (a good process is outlined 

7. The portion of the exit process done by HR should include asking the IT person to sign a statement concerning their termination.  It should state that they understand they are still covered by the legal obligations of HIPAA and other relevant laws and regulations, are required to return all of the practice's property, and they are no longer authorized to access practice computer systems and networks. If needed, the IT person should be asked to list any undocumented passwords - and you should verify they work.  As a measure of your good faith, HR and your consultant can work with the departing IT person to provide reasonable return of information, such as contacts or personal information stored on the practice's computers. 

8. Make sure you're covered during the transition.  Ensure you'll have interim help, a temp or replacement IT person to step in and keep things running.  In addition to providing daily support, they can also assist you in tasks such as revising job descriptions, insuring any expiring contracts are followed up on, and in rehiring a new IT person.

9. Ensure access to tech support and services.  Knowing who to call or email to get tech support and services is very important.  But you'll likely discover that many services are tied to a particular person and not the practice itself.  Vendors' technical support may be limited to one or two key contact staff.  Having your interim IT person update this information BEFORE problems happen will save you a lot of heartache. 

10. Keep the IT person's email address active - with a new password, of course - for at least a year after she leaves.  It's virtually certain that you're going to miss a thing or two in reviewing all your software licenses, web domain registrations, contract and service renewals, etc.  Monitor it, daily at first and once a week as time goes on. The person monitoring the email should unsubscribe all general email list subscriptions, such as tech newsletters, which will dramatically the volume of email and streamline monitoring.

My final piece of advice bears repeating: whether you're going to fire your IT person or not, an up-to-date business contingency plan is important protection for your practice -and it's required by HIPAA!

Here are 10 things you should consider if you are planning to let go of your practice's IT person or vendor. Don't act rash! 

Letting Go of Your Practice's IT Person or Vendor

Call it what you like, whether it's your, "hit by a bus," "won the lottery," or even the "unfortunately I had to fire her" plan.  Personally, I take the old "In case of emergency, break glass" signs as my shorthand, dubbing it my "break the glass" access plan.  Because if you suddenly lose IT staff, you may end up in a world of hurt if you haven't set up emergency IT access. 

IT staff often control many systems essential to your practice's daily operations.  These include the servers, storage devices, internet connections, and firewalls in your offices.  Also keep in mind a variety of programs and systems such as your EHR, billing systems, HR systems, etc.  And, finally, there are issues involving access to vendors, technical support, and cloud services.  While many of these can hum along fine without immediate IT assistance, inevitably there will a need to fix a problem or make a change.  If your IT staff isn't available, these things can present big problems for you and your practice.

You can't yet clone your IT staff or automatically download their knowledge, so it's important that you have prepared and have documentation in place if they're not available. If this sounds like an awkward conversation with IT, approach it as a core piece of your disaster recovery / business continuity plan.  The plan is required to be completed and regularly updated by the HIPAA Security Rule.  

Where to start?  The truth is that you don't have to be an IT person to understand some reasonable measures to protect your practice. Here are a few key considerations to include in your discussion with your IT staff to get you started.

 Almost all tech products come with an administrator user account, responsible for management of the system.  The admin account has the ability to create, delete, and install things like programs and create, update, or delete user accounts.  In almost all cases, there can be multiple admin users and having them is an accepted best practice. 

Separate admin accounts for each authorized IT user also means that you can audit who made changes, an important accountability consideration.  And, of course, it also means that you can disable or suspend one user's admin account and still have another working admin account if you need it.  With only one admin account, you may not be able to control your systems (e.g., if the admin password is changed or simply not documented) - including limiting access by a former employee.  Indeed, part of my "break the glass" access plan includes an entirely separate emergency access admin account, with its login name and password kept in a secure, off-site location not accessible to IT staff.

 Hardware and network equipment such as routers, switches, and firewalls will also have admin accounts.  In some cases these may not allow for multiple admin users, so it will be important to have those accounts and passwords documented in case your IT person is unavailable.  The best practice is to have this information securely stored offsite, e.g., in a practice-owned safe deposit box.

 Whether on servers in your offices or at a cloud vendor, applications such as your EHR will have admin accounts.  Again, if possible, these should be assigned to more than one staff member.  Without this, you may not be able to add or remove accounts or make changes to the application (e.g., list items within menus, etc.)  If you're using a cloud vendor, ensure the vendor understands that the practice CEO should always be authorized to change key user permissions.    

 More than ever, the complexity of technology means that almost all practices rely on vendors to support key aspects of operations.  When a change is needed or a problem occurs, you don't want to hit a brick wall, not knowing who to contact to get things resolved.  Both a list of vendor contacts 

 ensuring that multiple staff are listed by the vendor as authorized contacts (e.g., the IT person and the practice CEO) will avoid many problems in the future. 

 If you have a website, there are at least two things you'll want to have a handle on.  First, access to the website to update or make changes to it - whether this editing is done in-house or through a vendor.  Second, every website has a "domain name registration" record, which is important because if the registered "administrative contact" is an employee who leaves your practice, you may not receive notice to renew your domain registration.  If the registration expires without renewal, anyone can register your domain name, taking it away from you. One best practice to avoid this is to use a generic email address, such as 

, which can be forwarded to another employee if needed.  All website domain registrations are made and renewed through entities called "domain registrars," and you should ensure that login information for the account with the registrar is documented in case the IT person isn't.  Without these things in place, you may need to go through a sometimes burdensome process to prove to the registrar that you legitimately represent the domain name ownership.

 The typical practice has a lot of software, ranging from their EHR and billing systems, to software for HR - and even Microsoft Office.  All of this software is subject to licensing terms such as how many users or copies of the software are permitted, and these days most software is licensed for a specific period, rather than a "perpetual" license.  As with the web domain registration, if you don't have account information with the vendor documented, you may miss out on renewal notices.  You also may find that only named authorized users are permitted to access technical support in the event of a problem.  

If your IT person leaves your practice, you need to be prepared to take over his duties and ensure things continue to run smoothly.

Ensure Emergency Access for Your Practice's IT Systems

Remote access to your practice's electronic systems has gone from being a "nice to have" to a "must have" over the past few years.  We love our mobile devices and the freedom to access information whether in the office, at home, or on the road. Part of the credit for this is the rise of cloud-based practice management (PM) and EHR systems.  With cloud services, all of your practice's users, in the office or not, have "remote access" through the internet. 

These cloud systems relieve you of the responsibility to setup and administer encryption and security for remote access on the server side.  In almost all cases, leaving this to an experienced cloud vendor will improve operational security, as they have specialized staff and tools for management processes. 

However, even if you have moved your PM/EHR to the cloud, you are still responsible for your practice's devices and confidential data transmitted over the public internet. And while out-sourcing the security risks of hosting your data to professionals, remote access to data remains among the most risky aspects of securing your data,  avoiding a data breach or a HIPAA violation.  Of course, if you're hosting your own servers,  you own the entire responsibility for protecting your data. 

If you have IT staff, they can provide guidance on how to keep things as secure as possible.  Listen to and follow that advice!  You will need a HIPAA Security Risk Assessment for your practice, and how you secure remote access is a vital piece of that puzzle.  Even if your systems are in the cloud, you need to attend to four important elements.

Even if all else is perfectly secure, it may not matter if your device isn't.  Ensure that you apply all software updates, including regularly updated anti-virus and anti-malware software.  Use good passwords, don't make it too easy for a bad guy to get into your device.  Enable encryption of the device itself and its storage, this can easily be done on iOS, Android, macOS, and Windows.  In the real world --- and in the eyes of HIPAA enforcers – an encrypted device is at very low risk of data loss. Set your device to lock (go to a password-protected screensaver) after a short period of non-use. And, finally, don't neglect physical security, especially when travelling with a mobile device. 

Data travelling across the internet is not encrypted and susceptible to being copied and read by others.  If you access your data through a web browser, ensure that the connection is encrypted, look for the https:// in the browser address bar.  But realize that this doesn't protect non-browser data (e.g., email or other stand-alone apps for messaging and social networking).  The best security is provided by a VPN service, which encrypts all data coming into and out of your device.  This is especially important if you use public WiFi, since other devices in that coffee shop or hotel lobby may be able to connect directly to your device and hack it.  The best choice is to purchase and use a cellular WiFi hotspot or tethering from your cellphone.

It's always best to work with data stored in a secure cloud service.  Don't download or copy data to your device's local storage.  An Excel spreadsheet with confidential data stored on your laptop is a data breach waiting to happen.  Realize that "regular" email is NOT secure, and if you access secure email, do so only through a secure web browser connection (i.e., encrypted and the email data stays in the cloud.) NEVER put confidential data on an unencrypted flash drive or portable hard drive.  Even if you're accessing data via an https:// encrypted connection, it's a good idea to change your browser settings so the browser's data cache (stored data from your session) is wiped each time the browser is closed.

Most of us are aware of safe computing practices, but a lot of us trade off short-term convenience for security.   Just like eating more fruits and vegetables, we all know what we should do and sometimes even follow it.  Don't use trivially easy-to-guess passwords and don't use the same password on multiple websites or systems.  Don't click on links in phishing emails.  Don't share your password with others - or if you have to, change it immediately afterwards.  Never leave your laptop or phone visible in a locked car, put it in the trunk or glove box, or better yet take it with you.   Yes, you really DO need to eat that broccoli!

Securing remote access (whether at home or on the road) is an important component of your HIPAA compliance and ensuring the confidentiality of sensitive patient and business information for your practice.  And, of course, securing this confidential data is just the right thing to do.

Remote access to your practice's systems is a must this day and age, which means remotely securing this access is a must as well. 

4 Elements of Securing Remote Access to EHR, PM Systems

The explosive growth of computing and mobile devices has been both a boon and a burden for healthcare.  Anytime, anywhere access to patient information is a great thing, albeit one that comes at with potentially high hidden physical costs. 

Indeed prolonged improper use of computing devices can cause physical harm unless ergonomic risks are addressed.   As just one example, the OSHA Safety Pays Program estimates the direct cost of carpal tunnel syndrome at $30,000, with indirect costs and impact (e.g., lost productivity / time away from the job, etc.) doubling that.   

You're likely aware of these risks - heck, you may treat patients with these issues!  But just like there may be a prevalence of unhealthy sweets and treats in medical practice break rooms, we don't always practice what we preach.  The start of a new year is a great time to reset priorities and take steps improve the ergonomics of your office. 

Start with the obvious: your office may not have been designed with digital devices in mind.  Ideally, the budget for any new technology implementation will include funds for evaluating the office environment and making optimal changes needed to minimize ergonomic risks.  However, technology is too often shoehorned into already crowded work spaces, setting the stage for ergonomic injuries.  Moreover, with so many other urgent priorities in modern medical practices, discussion and actions to stem ergonomic issues may arise too late, when someone comes forward with chronic pain or injury.

Even without the budget for a substantial remodel, you can educate yourself on best practices for using technology, make small impactful changes to the office environment and educate staff for healthier computing. 

OSHA provides a convenient "eTool" for evaluating and improving computer workstations (

https://www.osha.gov/SLTC/etools/computerworkstations/

 is a very readable summary of solid recommendations for how to ergonomically optimize your workplace  .

One thing you'll quickly notice is that the recommendations are primarily centered on traditional desktop PCs.  However the sales of traditional desktop PCs have been declining for several years, with laptops, convertible devices and tablets selling in far greater numbers.  Today's laptops are miracles of sleek mobility.  But the designs we love present issues for prolonged, regular use, with compact (i.e., cramped) keyboards, small, often glossy (i.e., eye-straining) screens fixed an inch or so above the keyboard.  Tablets, because of their still smaller size and various modes of use also have risks.

Once you've refreshed your commitment to reducing risks, here are some basic steps to take:

• Analyze workflow routines and the environment where devices are used.  You may find awkwardly placed monitors, keyboards, or peripherals in at the front desk, back office, or patient care areas.

• Use a consultant who can help you not only identify ergonomic issues, but is also familiar with a wide variety of products you otherwise of which you might not be aware.

• Laptops are sometimes used as a "cheat" in cramped areas or are set on surfaces too low (or high) for comfortable use. Consider minor changes to improve their ergonomics (e.g., elevate a laptop for proper screen height and use and external keyboard to reduce strain.)  Also look at other choices such as adjustable wall mounts, keyboard floats, or rolling carts or tables for laptops.

• Talk with staff as you examine your office: educate them about ergonomic risks and encourage them to speak up if they're having a problem. 

• Design for devices with multiple users - chairs, keyboard floats, and even wall mounts should be easily adjustable if needed.

• Consider alternates such as specialized medical voice recognition software (e.g., Dragon Medical.)  If you had a bad experience with these products in the past: look at them again as they've dramatically improved in recent years.  Informal training or mentoring of new users can go a long way to ensure adoption and use of this technology, and you'll likely find it improves productivity as well.

Above all, don't be afraid you'll be "opening a can of worms" by bringing up the topic of workplace ergonomics.  Sure, some providers or staff may use this as an opportunity to complain.  But given the risks - and costs- of ergonomic injuries, raising the topic and discussing possible solutions is an important step.  And it will also let them know you want to keep them as healthy, productive members of your team.

https://www.osha.gov/dcsp/smallbusiness/safetypays/estimator_text.html#indirect

Many practices don't address potential ergonomics issues until it's too late and someone has chronic pain or injury. This is a mistake. 