Selecting an Electronic Medical Records System: Choose Wisely

Choosing the right Electronic Medical Records System (EMR) for a particular medical practice can feel like a daunting task. There are hundreds of options in the marketplace making it difficult for an organization to sift through all the available systems and then make a selection. A further complication is the process of selecting the perfect information technology for a specific medical practice. This complex process requires a real examination of the workflow for one’s particular office.

Software companies continually promote through marketing campaigns the idea that marketplace consumers simply need to purchase software, insert the disk, press OK and begin using the software. When a small business is attempting to apply technology to their workflow, the process can become significantly more complex and involved.

Industries such as accounting, legal and financial services typically staff a full-time employee to manage the implementation of their business software. Some private medical practices may have the resources for this approach but without this dedicated position it is risk as most physicians are not familiar with the technologies involved.

To help get your medical practice started, I have outlined a phased approach to evaluate, select, deploy, and continuously improve an implementation of an EMR. This is by no means an all-inclusive “how-to guide” but rather a guide to begin the process of EMR implementation.

Phase 1: Identify the Need

Identify the people in your organization that will be responsible for the success of the EMR implementation. In a smaller practice this is typically a doctor and the office manager.

Once the team has been selected, start to create the criteria that you will use to review and evaluate potential EMR solutions. This is an important step to take if the plan includes the evaluation of multiple software platforms. It is much easier to compare options with a predetermined set of criteria.

Investigate the U.S. Government Economic Stimulus Program to ensure that you are a qualifying practitioner. For information click here to view our FAQ.

Ask yourself this question. What are my expectations of EMR in streamlining the daily business routines in my office?  There are a whole host of features available as part of any qualifying EMR platform, i.e., e-prescription , faxing, referral letters just to list a few. It is important to first determine what features will most benefit your specific practice and what features fall into the “nice to have but not necessary” category. Completion of phase one will frame your requirements and establish a budget for this project. The number of “beneficial” features is directly proportionate to the cost and budget requirements.

Phase 2: Examine the Workflow 

Once you have an idea of the features you would like to apply to your medical practice the next step is to determine those features that will be used on a daily basis. The best way to accomplish this is to examine the current workflow in the office.

Take a close look at how you run the practice today in the paper world and ask these questions:

• What are the steps taken with each patient?
• What parts of your paper notes do you really like?
• What’s really challenging?
• What efficiencies or limitations do you have in your practice?
• What do you hope to accomplish with an EMR?
• Is time wasted looking for misfiled patient charts?
• Is phone tag with patients an ongoing occurrence because access to the information is not always available?
• Do lab reports take forever to get into a patient chart?
• Does printing appropriate patient education materials with the push of a button seem appealing?
• Do decision support tools matter?

Performing this exercise should help identify how to gain tangible benefits from an EMR system.  A sample list of criteria was created to help your office get started. Please email me to request a copy.

Phase 3: Solicit Proposals

Begin meeting with potential vendors now that you are armed with a list of selection criteria. It’s a good idea to exclude software options that are not CCHIT certified. EMR that meet the 2008 CCHIT certification standards already adhere to rigorous standards for interoperability and e-prescription. These and a host of other items will likely be requirements for your practice to qualify for federal stimulus funding.

Keep in mind when interviewing potential vendors that not all offers are the same. Some companies will offer software only, services only or some will offer both. It is always a good idea to have the same vendor that sells you the solution also be the one required to support your EMR. Proposals should include a description of how the vendor intends to move from paper to electronic data files and the one time cost to accomplish the change over. The proposal should also include an exact description of the vendor support program for your practice in the future and the ongoing costs to provide this service.

Phase 4: Implementation of EMR

Following the completion of vendor selection it is time to start the implementation of your electronic medical records system. The selected vendor should have outlined a phased approach to include:

• Purchasing, configuring and deploying the new hardware and software
• Examining your existing workflow and paper charts
• Applying lessons and insight from that examination to the business workflow of your EMR software
• Training everyone in your office to use the new software
• Repeated training if needed in your office to ensure competency with the new software
• Periodic follow up with everyone in the office to make sure they know how to use the software
• Follow up to make the necessary adjustments

Both the vendor and the practice need to adopt a “whatever it takes” attitude when it comes to making the transition work. The best vendor in the world will be unsuccessful if there is a lot of resistance from team members in the practice. Likewise, a rigid vendor that is more focused on the number of hours worked than actually getting the job done will likely contribute to a failed implementation.

Phase 5: Support is Critical

A well-designed and well-implemented EMR system is a great foundation, but it is not the end of the process. Software can be temperamental and sometimes users forget how to do something that they learned in training. EMR requires consistent practice for members who use the software to achieve the real benefits. Additionally, consistent use will likely be a key requirement to meeting the government’s “meaningful use” definition. That means that the software and the network that the system resides on must work reliably which is why it’s important to ensure that you’ve selected a vendor who has the ability and intention to support your practice long term. It’s important to understand when reviewing the vendor proposal, exactly how the company intends to support your medical staff users, your network and your data after the system has been deployed.

• Who will be called when there is a problem?
• What is the average turn-around time for support?
• How will systems and data be backed up for your office?
• What countermeasures and processes has the vendor put in place to ensure that your practice meets and stays current with the industry regulatory requirements i.e., HIPPA?

When making the important decision on the selection of a long lasting EMR system and vendor relationship, it is necessary and critical to take time. The failure rate for EMR implementations undertaken is 30% to 40%. An impulsive purchase of an EMR system is therefore ill advised. It is important to have everyone on-board at the practice with the decision, as it is vital to the success of this project. Using a selection process that’s methodical, critical and inquisitive will go a long way to help your practice succeed with electronic medical records.

Endsight works in partnership with gloStream and can help with the complexity of this process. Endsight provides an inclusive solution designed to help busy physicians like you through the change of migrating to electronic medical records. The process is called gloDNA and it stands for Detailed Needs Analysis.  Included is a slide show that provides more detail about this approach. Click here to learn more and to schedule a practice consultation.

Beware of Facebook frauds and Google goons | Adventures in IT - InfoWorld

Social media and search engine scams are on the rise. Cyberthieves are finding new ways to slip onto your computer and into your pocket. Are you really sure you’re safe?

If any of my Facebook friends get a message from me that reads like this, “I’m in a Turkish prison and need you to wire me $1,000 dollars.”  Please try to call my wife first.  She’ll know what to do. 

Scams and shams are increasing on Google and other popular sites.  The cyber world is a dangerous place where the bad guys can look like good guys.  I encourage you to give this article a good read.  (Read the article by clicking here)

To avoid internet viruses and other traps intended to download malicious software on your machine it’s important to:

1. Implement a centrally managed antivirus solution

4. Consider restricting network / user permissions with regard to software downloads

We’ve baked these countermeasures into our outsourced IT service approach.    If you’re concerned about your exposure to the cyber slime, contact us, and let’s discuss your options.

Is Cloud Computing just Hosting by another Name? | Cloud Computing - InfoWorld

It’s an interesting question.  As small businesses, we will need to make sense of “cloud computing” and to try to determine what sort of impact, if any, this new concept will have on our business.  Eric Knorr’s take on the difference between cloud computing and hosting is interesting.  I think it does a fair job of trying to distinguish between the two concepts, but as with most articles I read, this is geared more towards the enterprise IT department.

Check our Eric’s article: http://www.infoworld.com/d/cloud-computing/cloud-computing-just-hosting-another-name-453?source=IFWNLE_nlt_blogs_2009-06-15 

Basically, “cloud computing” is the industry’s new description for IT resources such as e-mail, being hosted somewhere other than on a server that sits in our office.  One of the distinctions between “cloud computing” and “hosting” is that with the cloud, we don’t have any idea where our data resides.  I think a great example of a “cloud” application would be Gmail.  We can log into our mail from a Webpage but we don’t have any idea where the e-mail resides exactly.  This is because Google has low-cost servers located all over the world and they use sophisticated load-balancing technology that moves information and data around their computing grid.  This approach allows us to use e-mail as a service, but it limits our control over the data.

Hosting is similar to cloud computing in at the IT resource resides outside of our corporate computing environment.  But unlike cloud computing, we know exactly, where our data resides.  Hosted Exchange, a Microsoft product, is a great example of this concept.  With this approach, e-mail resides off site at a co-location facility.  We know where the co-location facility is and we know, where the server or in many cases virtual server is located.  The same load-balancing concept applies to hosting in most cases, but it’s on a much smaller scale.  And it’s managed by the local hosting company or IT partner as opposed to Google.  The solution is less distributed, but it affords us more control.  

Regardless of what we call it or the specific architecture we apply there’s a good chance that our next major computing infrastructure upgrade will be to the cloud.  There’s just too many good reasons not to move services such as e-mail, file servers, and database applications out of our server closet and into a data center:

1. Disaster Recovery / Business Continuity: Moving our key server infrastructure to the cloud allows us to take advantage of all of the disaster preparedness countermeasures built into an enterprise class co-location facility.  These buildings are constructed to withstand earthquakes, fires, power disruptions and other “acts of God.”  They employ both physical and technological security that meets the most stringent regulatory requirements and most of them feature backbone access to the Internet with multiple redundant connections.  The end result is that if a disaster strikes our office, our computer systems weren’t there to be destroyed.  So long as our employees can access to the Internet, they can access our computing infrastructure and get back to work.

2. Scalability: Moving our servers to an enterprise class server and storage array that uses virtual technology allows us to access only the computing power that we need.  As our business grows, we simply add more computing power.  We don’t have to worry anymore about buying new equipment or what we will do with that equipment after a particular project is done.

3. Reduce Capital Costs: The cloud gives us the ability to pay a fixed monthly fee for our server infrastructure as opposed to laying out tons of cash to purchase all the equiptment  we need for a major network upgrade.  Instead, we only pay for what we need.

The key point that I gleaned from Eric’s article is this.  In the small-business space, many offerings will be cookie-cutter. (Like Gmail)  Small businesses using this service will not have the rich feature set that comes with an implementation of Microsoft Exchange.  In my experience, a cookie-cutter approach for something like e-mail will not work for the vast majority of small businesses.  As we explore our options for hosted or cloud solutions we need to be able to customize the offerings and service levels associated with those offerings.

The good news is that we won’t have to make these decisions immediately.  Microsoft relseased Windows Server 2008 and developers will soon be releasing business software maximised for the new platform.  The best way to explore a hosted / cloud infrastructure is too include it as an option in our next major upgrade.  

Endisght is already talking to a number of clients about this option right now.  Feel free to contact us if you’d like to talk about it to.

Make sure you have a handle on your IT resources

2009 has been a tumultuous year for the small-business Owner. Cutbacks and spending freezes from our customers have forced many of us to make some very difficult decisions with regards to employee retention.

Some of us have been forced to lay off some really good people as we attempt to reduce our cost structures, collect on outstanding receivables and most importantly find new revenue.

I came across a recent article by Roger Grimes entitled “Do you have a handle on your managed resources?” The article is really geared towards a larger IT department but I think it sheds some light on a new challenge that the small-business owner needs to consider.

From a computer infrastructure perspective each employee must exist as a user on the network. In addition to being assigned a physical workstation, that user needs the workstation to be assigned as a resource on the network. Each user and resource are then granted permissions and assigned to groups based on their job roles.

For example, you hire a new controller, and want to give him or her a workstation with access to email, shared files and your accounting data.

To accomplish that on the network your controller is created as a network users in your network directory. He or she is then assigned a workstation as a resource. The controller is granted permission to access email, shared files and your small businesses accounting system as a member of the finance group.

Proper maintenance of this directory is essential to maintaining a secure, reliable computing environment. As new employees start and others move on, this directory must be updated to avoid risks to security. (stale accounts give malicious hackers great opportunities to exploit your network)

This is a difficult process to maintain under normal circumstances, but for the last nine months our business environment has been chaotic. It’s a good bet that network directory maintenance has taken a backseat to far more pressing issues. But it should be addressed and the sooner the better.

Roger’s article is a pretty easy read and it should help provide some direction for those of you that feel like you can take care of this issue by yourself. But as Roger related his story, it’s really easy to delete items from the directory and cause a catastrophe. (Follow this link to read the specific example) So if you’re going to attempt to do this yourself you need to know that you might delete something that could take your entire network down.

At Endsight, we’ve developed add move and change policies that we’ve baked into our internal systems and procedures. Our team does this all the time and we can guarantee our work. If you need help with this issue or with any other aspects of managing your computer network please feel free to contact us.

Firms Not Cutting IT Security

This is an article I found in business weekly which addresses Endsight’s main IT Security direction. Although the economy is down, companies cannot afford to skimp on security and IT maintenance. Endsight now offers virus and spam protection at the desktop and server levels. Many of our clients are realizing the value in protecting their most important asset- their knowledge. Back up is becoming more practicle, affordable and important these days. It’s a safe guard that many companies only realize the importance of once its too late.

Please enjoy this article written by Stewart Baines of silicon.com

Despite tight budgets, CIOs, faced with rising threats from malware and disgruntled employees, have decided it pays to be wary, surveys show

With IT budgets flat or declining, you might have expected security spending to be similarly under pressure. But it seems CIOs faced with rising threats—including those from malware and disgruntled employees—have decided that it pays to be wary.

Indeed, several surveys have reported that enterprises are increasing their security budgets in 2009 despite cuts in overall IT budgets, with tech chiefs expecting security issues to grow this year as a result of the economic uncertainty.

Speaking to IT directors, the story is the same: downturn or not, cutting security spending is not worth the risk.

Jane Kimberlin, the IT director of Domino’s Pizza, which is bucking the trend of depressing financial results thanks to diners downsizing to a takeaway, said: “We are in fortunate position of finding the downturn not affecting sales. Consequently I am not experiencing any budget constraints at all.

“Having said that, I don’t think we would ever reduce our security budgets. I often talk to other CIOs in the FTSE 250 and it’s not something anyone has said they would do.”

Similarly David Supple, IT director for Ecotec, a management consultancy working in the public sector, said despite the tricky economic climate: “Overall our IT security budgets are not down a lot.”

Crisis, what crisis?
So with IT security budgets largely intact, are companies well prepared for the challenges ahead? Over the past year there have been a string of high profile data breaches, and embarrassing cases of lost laptops, USB drives and CDs in the public and private sector.

But the fear is that such mistakes could be replaced with the deliberate theft of data, with disgruntled former employers made redundant in the downturn fuelling the insider threat to IT security.

Alan Rodger, senior research analyst, Butler Group said: “The insider threat is the most significant. With people’s jobs coming under threat, some will make the most of the opportunity before they leave. For others, simply being told their pay is being cut might inspire them to breach security.

“Investment over the years has focused on security threats outside of the organisation but I believe companies now need to spend a lot more time looking at the threats from within.”

Rodger’s stance is underlined by a recent Ponemon Institute survey of 950 people who had lost or left their jobs during the last 12 months. The research found nearly 60 per cent of them took company information, such as customer contacts, when they left.

The threat of flexibility
As the downturn rumbles on, there is pressure from business managers to be more flexible and cut costs: get closer to customers, work from home more often, and reduce the overhead on centralised offices. The counterpoint is that data leaves the once fortified confines of a company’s premises.

“My internal customers need to be more mobile and so we have seen an explosion of devices on market like netbooks which help them do this. I have to get the balance between making services accessible and security, and security has to win every time,” Domino’s Kimberlin said.

“But we have to recognise that there is a blurring between our work and personal lives so if our employees want to use social networking for instance, we let them do it as long as it doesn’t compromise our security,” she continued.

Ecotec’s Supple added: “Employees are working at weekends and in the evenings from home, maybe when they were not doing it before and using equipment that is not ours,” adds Supple. “Our perimeter has grown.”

So what can an IT director do when faced with conflicting pressures to make working practices more flexible, yet make access to sensitive corporate data more secure, particularly when there is little money around for investment in anything other than business-as-usual security? The trick is to focus investment on where it makes a difference.
Burton analyst Rodger said: “Over the years, most IT security projects have not had to be qualified by a business case but that is changing. Many businesses are recognising that they need to assess the risk, and find a balance between financial cost and the probability of a breach happening.

“When you understand the risk—and how the economic crisis could increase risks—you stop making short-term cost savings in the IT security budgets in ways that leaves you open to the worst risks.”

http://www.businessweek.com/globalbiz/content/mar2009/gb2009039_621530.htm?chan=top+news_top+news+index+-+temp_global+business