1

HIEs to the Rescue! From Harvey and Flint to Cyber Response

Session 226, March 8, 2018

2

Doug Dietzman

Has no real or apparent conflicts of interest to report.

Dan Porreca

Has no real or apparent conflicts of interest to report.

Nick Bonvino

Has no real or apparent conflicts of interest to report.

Conflict of Interest

3

Doug Dietzman

Executive Director

Great Lakes Health Connect

4

GLHC’s Statewide Network

• 129 Hospitals

(85% of Acute Beds)

• +4,000 Connected

Participants

• More than 9.4 million patients

• Over 1 Billion messages p/y

5

Local Community Engagement

6

Flint Community

• Working for years to integrate healthcare ecosystem across Flint region – Greater Flint Health Coalition

• Water crisis presented another “reason why” connected communities are vital to residents

• GLHC recognized need for advancing data infrastructure to support healthcare & wellness goals of those affected in short and long term

• Longitudinal health record, referral/care coordination, clinical messaging, active health monitoring, intelligent alerts

• Physical health, Behavioral health, Social services, Schools, Local public health

7

Challenges

What often stands in the way

of establishing this infrastructure

across communities:

• Politics

• Cost

• Education

• Workflow integration & usage

• Implementation resources

• Busy-ness

• Nobody wants to buy insurance

8

9

Activities

• EMR integration

(FQHC, CMH,

Child Health Center)

• VIPR record

• School Nurses

• Community CHAP program

• Pediatric & other providers

across the community

• “Potential/Actual” exposed patient

identification from hospitals

• Posting child assessments to VIPR

• Referrals / Care Coordination

• Community-wide Reporting

• Diagnostic Lead Testing Results

• Lead Poisoning Symptoms

Risk Report

10

Perspectives

• Natural and Man-made disasters demonstrate over and over the

importance of a strong, integrated healthcare communities

• Technology alone cannot integrate the heterogeneous business and

practice of medicine

• Ultimately, this work boils down to enabling the broad healthcare

community to support the care and wellness of each child in Flint,

wherever they show up for services, now and in the years to come

• Community-based exchange organizations are a vital to care-

connected communities

11

Dan Porreca

Executive Director

HEALTHeLINK

12

Agenda

• Ransomware Threat

• HEALTHeLINK background

• Ransomware – Cyber Security Attack

• HEALTHeLINK Response Timeline

• Lessons Learned

13

Are You Ready?

Ransomware Cyber Attacks coming

to a healthcare institution near you…

• 6 of the top 10 HIPAA breaches

reported to HHS in 2017 were the

result of ransomware attacks.

(HHS Office for Civil Rights Breach Portal)

• Kaspersky’s 2016 Security Bulletin reported

that 16% of ransomware attacks targeted healthcare;

however, Solutionary says that 88% of successful ransomware attacks

in Q2 2016 hit the healthcare industry.

14

About HEALTHeLINK• Support 8 western counties of NYS

• Part of the SHIN-NY

• Member of SHIEC

• Stats:

– Over 1,000 Participant Organizations

• 5,000 providers and 20,000 users

– More than 200 million results available

– Over 530,000 results delivered monthly

– Over 205,000 patient queries monthly

• A query happens every 10 seconds

15

Value of Regional HIE’s

ElevatorPitch

16

Erie County Medical Center

• 583 inpatient beds

• 30 outpatient specialty care services

• 390-bed long-term care facility (Terrace View)

• Level 1 Adult Trauma Center

• Regional center for burn care, behavioral health services,

transplantation, medical oncology and head & neck

cancer care, rehabilitation and a major teaching facility

for the University at Buffalo

17

RansomwareCyber Security Attack

Situation: All information systems

at ECMC where unavailable to

clinicians starting April 9, 2017 due

to ransomware cyber attack

18

Operational Impact

• Inpatient and

Outpatient EMR

• Scheduling

• Payroll

• Pharmacy

• Radiology

• Billing

• Lab system

• Bed tracking

system

19

HEALTHeLINK Response Timeline

April 9

• 2am – systems unavailable due to cyber attack

• 11:14am – Text to Dan and Steve

from off duty ED doctor

• 11:47am – HEALTHeLINK staff person on-call

• 1:00pm – HEALTHeLINK staff person on-site in ED

April 10

• 7 HEALTHeLINK staff on-site

April 10+ -

• Some on-site presence

What HEALTHeLINK

provided:

• Support for existing users to

access HEALTHeLINK directly,

versus via Meditech (EMR)

• Credentials and training

for new users

• ACCESS TO THEIR DATA!

20

Key Factors in the ECMC Success

• ECMC has been a supplier of data

to HEALTHeLINK for nearly 10 years

– In September of 2016, ECMC began sending

more detailed encounter data (C-CDA)

• ECMC staff were already active users of HEALTHeLINK

– low to no learning curve during the crisis

21

Key Lessons Learned

• HEALTHeLINK needs to be written into

every participants crisis response plan

to support business continuity

• HEALTHeLINK now has a crisis response

plan that considers the needs of the communities we are serving

– Working directly with provider organizations, county and state

agencies on crisis preparedness efforts (natural disasters and

mass casualty situations)

• More reason for every provider organization to get us their data

ElevatorPitch

22

Making the Best of a Bad Situation

Quote from ECMC

Chief Operating Officer:

“There were 2 things that

allowed us to get through this

as effectively as we did – cyber

insurance and HEALTHeLINK!”

23

Nick Bonvino

Chief Executive Officer

Greater Houston Health Connect

24

Fast Facts

Our Geography Our Reach*Collaborators

*A sample of our 300+ participants24 Counties

42 Hospitals = 74% of the

17,376 beds in our mkt

6,811 Physicians = 62%

5+ Million Unique Patients

300+ Fully-Executed

Participation Agreements

1,000+ Venues of Care

25

Mission: Coordinate Care by Connecting ALL Providers

• WE are Southeast TX’s HIE

• WE integrate disparate EHRs across the

community

• WE enable sharing of health information

across the ecosystem

• WE serve as the foundation for population

health management

• WE facilitate data exchange to better

inform decisions made at the point of care

• WE are a 501(c)(3), not-for-profit, here to

serve OUR community

Healthconnect

Radiology

Center

Clinic

Free

Standing

ED

Primary Care

Physician

Hospital

Specialist

Laboratory

Pharmacy

26

Core Service Lines

Health

Information

Exchange

Diagnostic

Imaging Exchange

Healthcare

Notifications

Query and retrieve

patient records

from across the

healthcare

ecosystem

Cloud-based image

exchange that

enables viewing

and sharing of

medical images

Real-time alerts when

patients admitted,

discharged or

transferred to-and-

from facilities

Health Information

Service Provider

(HISP)

Direct Secure

Messaging between

providers. Member

of DirectTrust and

the Trust Bundle

Research

Health services

and outcomes

academic research

using anonymized

HIE data

27

Additional Community Services

Syndromic

Surveillance

Public

Health

• Monitoring of

transmitted diseases

• City of Houston,

Harris County

• Electronic Lab

Reporting

• Immunizations

• Clinics

ETHAN

Project

• Emergency Telehealth

and Navigation

• 911 and ambulance

coordination and triage

28

Value Proposition

QUALITY SAFETY EFFICIENCY

Assessment• Provides historical information

• Alerts to prior interventions

• Informs on chronic conditions

• Advises current medications

• Advises on current allergies

• Informs of existing labs/rad

• Narrows problem lists

• Reduces unnecessary testing

Diagnosis• Includes diagnosis histories

• More complete info for new Dx

• Enables diagnosis precision

• Avoid unnecessary treatment

• Better Dx and Rx prevents

downstream recurrences

Care Planning• Delivers longitudinal records

• Facilitates holistic care planning

• More informed comprehensive

care team during transitions

• Seamless care transitions

• Improves accountabilities

E-Prescribing• Renders complete drug history

• Enables informed prescribing

• Active medication lists prevents

adverse drug events (ADEs)

• Reduces reliance on patient

recall or pharmacy call-backs

Clinical Decision

Support• EHR relies on community record to

identify best care protocols

• More data improves specificity of

care = safer care

• Narrows field of optimal

treatments, minimizes cost

29

Hurricane Harvey

30

Hurricane Harvey Overview

• August 25-29

Hurricane Harvey hits the Gulf Coast of Texas

• The storm moves east and stalls over the

Houston area, with record 52” rainfall

• Significant devastation and flooding along the

coast and inland

• Corpus Christi, Greater Houston, and

Beaumont/Port Arthur most impacted

• Storm eventually moved on to Louisiana

31

Hurricane Harvey Shelter SetupMegashelters established across state to support 30,000+ evacuees:

• Houston – 2 shelters, 14,000+

• Dallas – 1 shelter, 4,000+

• San Antonio – 1 shelter, 2,800+

• Austin – 1 shelter

32

Hurricane Harvey Pressing Need for Medical Histories

Shelters quickly swelled with

evacuees…

Many evacuees required

medical attention…

An urgent need arose for access

to patient medical information

and practice without an EHR!

33

Hurricane Harvey MobilizationPortal Provisioning Shelters Call-In Operations

• CHI – St Luke’s request to

provision additional clinicians

at all locations ahead of storm

• Coordinate with other HIEs -

portal and support for call-ins

• Coverage San Antonio, Austin,

Corpus Christi, Beaumont -Port

Arthur, Tyler-Texarkana, DFW

• Monday organized for need

• Tuesday on-site with evacuees and

volunteer clinicians - Confirmed

consent and queried for PHI at point-

of-care 24x7 thru weekend

• Embedded HIE into triage and

clinical workflow. Coordination with

Federal DMAT & FMS teams

• Remote calls from clinicians to

look-up PHI. Read results or

send secure email

• 24x7 support for 17 days

• “All hands on deck” – GHH staff

and alumni worked after-hours

and weekend shifts

34

Most physicians surprised by our capabilities

We were only ones with computers

Patient MO: diabetics, CV, dialysis

Common requests: medications, problem list, labs, notes, radiology

Hurricane Harvey Vignettes

Steady flow of patients

Call-in operations response time to requests, <2 mins

GHH staff and alumni volunteered time

“I will definitely write very positive things about GHH in my post-storm report”

- Ted Sikorski, MD – DMAT Commander

As hospitals became overloaded with phone calls, we became de facto source for information

Similarly, with many pharmacies closed, we were the source for medication data

35

Hurricane Harvey Impact

staff hours to

support shelters

937

653 70%total # of records accessed

during Harvey

Records found as % of

total requested

62%Query requests looking for

active medications

100%patients who opted in when

asked for consent at shelters

17# of consecutive days

with 24/7 call-in support

36

Hurricane Harvey Key Learnings

Observations• In chaos, no time to wait, asserted ourselves in

• Medical teams quickly incorporated us into workflow

• Rapid state-wide mobilization for call-in support

• The power of organic participation

Interesting Use Cases• Leveraging HIE to determine evacuee identity

• Using ADT to determine evacuee location

• Used CCD and recent encounter for TB look-up

• Enabled provider to access their EHR thru our laptop

Frustrations• No access to the few hospitals not connected

• Some returned CCDs were incomplete

• Patients in the MPI, but not consented to share

• We wanted to do more, but resources spread thin

The Future• Participation from ALL healthcare providers

• Providers improve documentation in CCDs

• Coordination and connectivity throughout state

• Incorporate and fund HIEs in

Emergency Management Programs

at the Fed, State, and Local levels

37

The Importance of a Community HIE

38

Nation-wide HIE Programs

Initiatives claim interoperability across all EHRs and no need for local HIEs

However, our experience suggests there are serious flaws…

AND, the hurricane reinforces the critical importance

of local HIE capability in disaster preparedness!

39

Top 5 Flaws in Nation-wide Initiatives

National Local HIE

1Insufficient Patient

Matching• On-the-fly query sends 5 patient attributes

– statistically insufficient

• ADT feed builds CMPI in advance of query

• 18 attributes and probabilistic algorithm

2Patient Consent not

Consistently Managed• Variation in patient consent models

among participants

• Opt-in model: informed consent response

stored and managed in CMPI

3Returns Multiple

CCDs to provider

• Delivering a C-CDA from each EHR will

overload caregivers resulting in missed

information

• CCDs aggregated into a single on-demand

document: data normalized, de-duplicated, and

more easily reconciled into EHR

4Can not support

Notification Services• Not possible

• Real-time alerts enabled by ADT feeds

• Timing of events not just the data

• Essential for managing at risk populations

5 No Clinical Portal • Not possible

• Reach to post-acute and non-certified EHRs

• Access to clinical info w/o EHR connectivity

• Population health use cases

40

Radiology

Center

ClinicFree Standing ED

Primary Care

Physician

Hospital Specialist

Laboratory

Pharmacy

Uniquely identify Patients

Across the Community

• ADT feeds from all Participants

builds Community MPI

• 18 attributes for each patient used

to overcome source data issues

• Populations in excess of 500,000

require probabilistic matching

algorithms

• Work que - Manual review of

‘probable matches’

Community HIEPatient Matching

ADT feed

ADT feed

Community Master Patient

Index

ADT feed

HealthconnectADT feed

41

Radiology

Center

ClinicFree Standing ED

Primary Care

Physician

Hospital Specialist

Laboratory

Pharmacy

GHH Consistently

Manages Consent

Across the Community

Community HIEManaging Patient Consent

ADT feed

ADT feed

ADT feed

ADT feed Healthconnect

42

Radiology

Center

ClinicFree Standing ED

Primary Care

Physician

Hospital Specialist

Laboratory

Pharmacy

• Record locator identifies patient

encounters pre-query

• Participants respond with C-CDA

and may contribute data feeds

• Data is parsed, normalized, de-

duplicated, and consolidated into a

single C-CDA

• Common style-sheet and standards

ease reconciliation into HER

• GHH Responds to Requestor* time from query to response is a few secs

Community HIEOn-Demand Clinical Documents

Healthconnect

43

Radiology

Center

ClinicFree Standing ED

Primary Care

Physician

Hospital Specialist

Laboratory

Pharmacy

HealthconnectNotifications

1. Participant identifies

patients to be monitored

2. GHH CMPI fed real-time

with all patient registrations

and activity via ADT feeds

3. Upon patient and ADT

match, alert is generated

and pushed to Participant

as desired

Community HIENotification Services

ADT feed

ADT feed

ADT feed

AD

T fe

ed

44

Radiology

Center

ClinicFree Standing ED

Primary Care

Physician

Hospital Specialist

Laboratory

Pharmacy

Online Clinical Portal

• Allows providers secure online

access to all patient information

• View clinical data without an EHR

• Care navigators can follow-up on

alerts viewing patient encounters

from across community in 1 place

Community HIEOnline Clinical Viewer

Healthconnect

45

Thank You!

Your doctors are connected. Your records are protected.

Wherever you go…