Norton Healthcare says it will alert 2.5 million patients whose personal information may have been compromised by cyberattack

Image from Spectrum News

About two and a half million people may have been affected by a ransomware attack on Norton Healthcare, the Louisville hospital company said Tuesday. It said they will get letters soon, alerting them that the attack "exposed a wide array of sensitive information," Valerie Chinn of WDRB reports.

The attack occured May 7-9. Norton spokeswoman Renee Murphy declined to tell WDRB how the incident was resolved. She said "We did not make any ransom payment" but would not say whether "the stolen information was returned as a result of an insurance claim," WDRB reports.

Last week, for the first time, Norton said it was the victim of a ransomware attack, had notified federal law enforcement officials and was "working with a respected forensic security provider to investigate and terminate the unauthorized access." It said its medical-record system and MyChart system for patients were not violated.  

However, Norton said the accessed files included personal information "primarily" about patients, employees and dependents. "Impacted information varied from person to person, and may have included name, contact information, Social Security number, date of birth, health information, insurance information, and medical identification numbers, Norton said. Driver's license numbers and other government ID numbers, financial account numbers or digital signatures may have also been included in the data," WDRB reports.

Norton said "Individuals whose information may have been impacted can sign up for two years of credit monitoring by following the instructions in written notification letters that are being mailed." It urged them to "remain vigilant and continue reviewing account statements for unusual activity."

Adrian Lauf, a computer science and engineering professor at University of Louisville, told WDRB that the compromised information suggested that insurance fraud is a possible threat, so past Norton patients shoulkd watch out for fraudulent insurance claims.

"Lauf also said to err on the side of caution, and suggests contacting a national credit bureau to either submit a fraud alert and/or initiate a credit freeze," WDRB reports. "He also suggests to verify or double-check and unknown numbers or emails that contact you."

Norton said the incident's "nature and scope . . . required time to analyze, a process that was substantially completed in mid-November."

A federal class-action lawsuit filed against Norton July 21 by employees and patients whose personal information was stolen from Norton's servers alleges that the company failed to notify those affected or the attorneys general of Kentucky and Indiana. A similar lawsuit was filed Dec. 14 "on behalf of Margaret Garrett of Crestwood and others nationwide who are or were patients or were affiliated with Norton," WDRB reports. Murphy told the station, "We take safeguarding personal information seriously and plan to vigorously defend ourselves in any litigation associated with the ransomware attack."

WDRB notes, "A hacker group called BlackCat claimed responsibility for the attack and leaked files as proof. . . . Employees' names, social security numbers and birth dates as well as patients' personal information, credit card numbers and medical history are contained in documents obtained by WDRB News and available publicly on the dark web, a corner of the internet accessible via specialized web browsers. They had not been redacted, and appear to be authentic.

"The documents appeared to show a large amount of Norton's financial information, including operating accounts and payroll accounts with a balance of tens of millions of dollars, credit card information, confidentiality agreements, patient imaging orders, vendor and bank information and business invoices. Norton serves about 600,000 patients a year with nearly $5 billion in assets."

In 2006, Congress ordered HHS to integrate health-data systems; it still hasn't been done, and that causes problems

Photo by Irwan, Unsplash

"The pandemic highlighted ineffective data infrastructure across the U.S. health system," reports Sam Whitehead of Kaiser Health News. "Coronavirus case reports sent by fax machine. Clunky tech for monitoring vaccine distribution. . . . Supply chain breakdowns that left health-care providers without needed protective equipment. . . . And Congress knew about the potential for these problems long before Covid. Lawmakers mandated the Department of Health and Human Services to better integrate U.S. data management systems to allow stakeholders to better share information years ago, in 2006."

Whitehead starts with a real-life example: "In early 2020, as they tried to fight covid-19 across two rural counties in North Carolina, the staff of Granville Vance Public Health was stymied, relying on outdated technology to track a fast-moving pandemic." They had to use "five data systems. One was decades old and complicated. Another was made of Excel spreadsheets. None worked well together or with systems at other levels of government."

Whitehead gives several reasons the data system wasn't improved: the complexity of the task and inadequate funding; a federal-first approach to health that deprives state and local agencies of resources; unclear ownership of the project in HHS; insufficient enforcement mechanisms to hold federal officials accountable; and little agreement on what data is even needed in an emergency."

Soumi Saha, senior vice president of government affairs at Premier, a health-technology company, told Whitehead, “What keeps me up at night is that we forget about the past two and a half years, and we just move on — that we don’t take the opportunity and time to truly reflect and make needed changes.”

Whitehead reports: "Different hospitals often use different electronic health-record systems, so are frequently unable to share patient data with one another, much less with the federal government. . . . Much of the 2019 bill mandating the data-sharing network’s creation is set to expire in September, and reauthorizing the law could be a challenge in a split Congress where House Republicans have announced their intention to examine the U.S. response to the pandemic."

Dr. Georges Benjamin, executive director of the American Public Health Association, told Whitehead, “Congress has an opportunity now to build the public health system. What are they doing? Undermining public health legal authorities, demonizing public health officials. It’s almost like we didn’t learn anything.”

Bill near final passage would delay lab results of cancer or genetic markers from going on electronic health records for 72 hours

UPDATE: March 30, The House concurred with the Senate, giving the bill final passage. 
UPDATE: March 29, The Senate passed HB 529 with a committee substitute 36-0. 

By Melissa Patrick
Kentucky Health News

The legislature is nearing final passage of a bill that would give health-care providers a chance to contact patients to go over certain laboratory results before they go on patients' electronic health records.

Rep. Killian Timoney

House Bill 529, sponsored by Killian Timoney, R-Lexington, would require pathology or radiology reports that may show a finding of malignancy, or test results that could reveal genetic markers, to not be disclosed to a patient as part of their electronic health record for 72 hours, unless the health-care provider directs their early release. 

The Senate Health and Welfare Committee approved the bill without dissent and put it on the chamber's consent calendar, which it uses to pass bills without further discussion.

Doctors told the committee that the bill is needed.

"As physicians, we are quite concerned that patients are receiving deadly, life-threatening diagnoses on their phones without any medical care and medical support. We have numerous accounts of patients being harmed because of that, and causing harm to themselves," said Dr. David Danhauer, chief medical information officer at Owensboro Health. "We ask that, with this bill, allow our providers time to review, contemplate a plan, and set up appropriate consultation with those patients."

Dr. Susanne Arnold, a medical oncologist and associate director of the University of Kentucky's Markey Cancer Center, told the committee that they believe 72 hours "is an appropriate length of time" in most situations to be able to have a face-to-face discussion with a patient about such serious diagnoses. 

Sen. Karen Berg, D-Louisville, a physician, praised the bill. "This can be a horrible, horrible situation for patients," she said. "Imagine, honestly, opening up your telephone and seeing the report that says advanced metastatic cancer and it's 5:30 on a Friday night and you don't even have anyone to call. That's unethical."

While presenting the bill March 9 in the House floor, where it passed 84-14, Timoney said it would apply to upwards of 4 percent of all tests, and give patients access to a trained professional instead of "Dr. Google" or WebMD. He referred to the bill as the Compassionate Patient Care Act. 

The bill has an emergency clause that would make it effective immediately upon enactment.

Rural residents appear less likely to use electronic health records, Indiana study finds; lack of broadband is one reason

UPI.com

Telemedicine, including online health records, is touted as a way to improve rural health. However, rural residents are less likely to use such technology, according to a study of 34 Indiana counties with high rates of cancer deaths, published in the latest issue of the Journal of Rural Health.

The study by researchers at the Indiana University Cancer Center and the university's Center for Survey Research found that rural patients were less likely to use electronic-health-record messaging systems, less likely to look up test results online, and less likely to use electronic medical records to "look for personal health information for someone else's medical record," which a caregiver might do. There was no significant difference in the use of email, texting or social media for health purposes, or in using electronic health records to ask a health-care provider to refill a prescription.

The availability of high-speed internet service, or lack of it, "emerged as a significant factor" in the use of electronic medical records, the researchers wrote. "Rural broadband has more commonly been discussed in terms of the benefit to economic development, but successful policies to expand broadband access also have the potential to improve health through patients’ access to, and use of, their EMR."

Electronic health records, touted as tool for efficiency and better care, are coming between doctors and patients, surgeon writes

Illustration by Ben Wiseman for The New Yorker

Electronic health records were supposed to "make medical care easier and more efficient," says The New Yorker. "But are screens coming between doctors and patients?" Yes, surgeon Atul Gawande writes in the magazine's latest issue, starting with a description of his 2015 training session on the Epic Systems Corp. system, which now has information on more than half of Americans.

"The new system would give us one platform for doing almost everything health professionals needed—recording and communicating our medical observations, sending prescriptions to a patient’s pharmacy, ordering tests and scans, viewing results, scheduling surgery, sending insurance bills. With Epic, paper lab-order slips, vital-signs charts, and hospital-ward records would disappear. We’d be greener, faster, better. But three years later I’ve come to feel that a system that promised to increase my mastery over my work has, instead, increased my work’s mastery over me. I’m not the only one," Gawande writes.

"A 2016 study found that physicians spent about two hours doing computer work for every hour spent face to face with a patient—whatever the brand of medical software. In the examination room, physicians devoted half of their patient time facing the screen to do electronic tasks. And these tasks were spilling over after hours. The University of Wisconsin found that the average workday for its family physicians had grown to eleven and a half hours. The result has been epidemic levels of burnout among clinicians. Forty per cent screen positive for depression, and seven per cent report suicidal thinking—almost double the rate of the general working population. Something’s gone terribly wrong. . . . We’ve reached a point where people in the medical profession actively, viscerally, volubly hate their computers."

Gawande offers many examples to show why. Here's one, gathered by talking to physician Susan Sadoughi: "Piecing together what’s important about the patient’s history is at times actually harder than when she had to leaf through a sheaf of paper records. Doctors’ handwritten notes were brief and to the point. With computers, however, the shortcut is to paste in whole blocks of information—an entire two-page imaging report, say—rather than selecting the relevant details. The next doctor must hunt through several pages to find what really matters. Multiply that by 20-some patients a day, and you can see Sadoughi’s problem."

Patience, counsels Gregg Meyer, chief clinical officer at Partners HealthCare, who supervised the software upgrade at Gawande's hospital. “We think of this as a system for us and it’s not,” he told Gawande. “It is for the patients.”

Gawande writes, "In Meyer’s view, we’re only just beginning to experience what patient benefits are possible. A recent study bolsters his case. Researchers looked at Medicare patients admitted to hospitals for fifteen common conditions, and analyzed how their 30-day death rates changed as their hospitals computerized. The results shifted over time. In the first year of the study, deaths actually increased 0.11 per cent for every new function added—an apparent cost of the digital learning curve. But after that deaths dropped 0.21 per cent a year for every function added."

“I’m playing the long game,” Meyer told Gawande. “I have full faith that all that stuff is just going to get better with time.”

Gawande concludes his long story with an episode involving a patient on whom he had turned his back to do a computer task during a pre-surgery visit. As they headed to surgery, he started to do that again, and thought better of it. He writes: "I angled the screen toward the couple. Side by side, we confirmed that his medical history was up to date, that the correct surgical site was marked on his body, that I’d reviewed his medication allergies. His shoulders began to relax. His wife’s did, too. 'Are you ready? I asked. 'I am,' he said."

Here's a sampling of views from health-care providers about health care and health in rural Kentucky

Louisville-based Medical News recently interviewed five health-care providers in Kentucky about the challenges that face rural health care: "Economic factors, cultural and social differences, educational shortcomings, sheer isolation with limited access to transportation and lack of recognition by legislators." Here are some excerpts:

Poverty and drugs compound each other, said Dr. Philip Hurley of Owensboro: "Whereas these addictions can affect all socioeconomic brackets, the effects on the poor tend to be more devastating as family and public support are often not as readily available. Obesity is another challenge. Sadly, our country has the dubious distinction of being the first country in history where the poor are obese."

Some noted the difficulty of attracting health-care providers to rural areas, but Dr. LaTonia Sweet of Molina Health in Louisville said, "Nowhere else can a physician use the same depth and breadth of skills needed as in rural healthcare. A physician can make a huge impact on the health of a community in rural areas."

"Rural areas work continuously to recruit talent for health-care delivery," said Dr. Brent Wright of the University of Louisville. "In addition to recruitment issues, there are continuous regulatory and technology demands that strain existing resources (electronic medical records, quality initiatives and value-based care). These initiatives drain resources from shrinking margins."

Hurley said electronic health records and telemedicine have helped rural Kentucky, "but most EHR records are close to garbage. It is often very difficult to glean useful, pertinent information. The electronic imaging and the ability to view it remotely is helpful."

Wright was more optimistic: "Telemedicine will see a resurgence as we all become more mobile through our smart devices. Brick and mortar healthcare will not be as necessary as bandwidth and connectivity increases. This is great for rural health because it means less travel and more access."

Asked what changes they would like to see to improve health care in rural Kentucky, Susan Starling of Marcum and Wallace Hospital in Irvine said "improved access to mental health, which has become very centralized in the urban areas; local access to alcohol and drug treatment centers; and support of critical access hospital programs and other federal programs that support rural health care."

Dr. Patrick Withrow of Paducah said he has been shocked by high suicide rates among farmers and other rural residents, which "need to be addressed. The wide geographic population and resultant limited mental and medical health resources in rural areas is a problem. Telemedicine may be a way to improve access to care. Also, the expansion of medical training to the more rural areas (Morehead, Bowling Green, Glasgow and northeast Kentucky) will improve access to care."

Feds find security flaws in Kynect; state says no data breaches; problems also found in federal exchange

State health-insurance exchanges in Kentucky, Vermont and California had "significant weaknesses" in protecting their electronic information from hackers, the Government Accountability Office said in a report last month.

"These included insufficient encryption and inadequately configured firewalls, among others," said the report from the investigating arm of Congress. "In September 2015, GAO reported these results to the three states, which generally agreed and have plans in place to address the weaknesses."

Ricardo Alonso-Zaldivar and Frankfort-based Adam Beam of The Associated Press report, "Vermont authorities would not discuss the findings, but officials in California and Kentucky said this week that there was no evidence hackers succeeded in stealing anything."

The report said the federal Centers for Medicare and Medicaid Services, which oversees the exchanges, had not fully implemented its oversight of their security and privacy protections.

"The GAO report examined the three states' systems from October 2013 to March 2015 and released an abbreviated, public version of its findings last month without identifying the states," AP reports. "Thursday, the GAO revealed the states' names in response to a Freedom of Information [Act] request from the AP. According to the GAO, one state did not encrypt passwords, potentially making it easy for hackers to gain access to individual accounts. One state did not properly use a filter to block hostile attempts to visit the website. And one state did not use the proper encryption on its servers, making it easier for hackers to get in. The report did not say which state had what problem."

Steve Beshear, who was governor until early December, told AP through a spokeswoman that "because of the time required to fix the technical issues, not all those issues had been addressed" when Republican Gov. Matt Bevin took over. "It is important to note that there were never any security breaches of any kind, and no one's information was ever compromised."

Doug Hogan, spokesman for the Cabinet for Health and Family Services, told AP the fixes "are in various stages of completion and implementation" and security is "of the utmost importance" to the Bevin administration.

Bevin is dismantling Kentucky's exchange, which Beshear branded as Kynect, and planning to transfer the 93,000-plus people who used it to buy federally subsidized policies to the federal exchange, Healthcare.gov.

"But Kentuckians' information might not be any safer on the federal exchange," AP reports. "According to the GAO report, Healthcare.gov had 316 security incidents between October 2013 and March 2015. Such incidents can include unauthorized access, disclosure of data or violations of security practices. None resulted in lost or stolen data, but the GAO said technical weaknesses with the federal system 'will likely continue to jeopardize the confidentiality, integrity and availability of Healthcare.gov.'"

Baptist Health joins national network that combines data to help patients get the best cancer care

Baptist Health has joined a national network that facilitates the sharing of health information with other hospitals in its network to improve and personalize cancer treatments, all while keeping its patient close to home, according to a Guardian Research Network news release.

With the addition of four new healthcare systems, including Baptist Health, GRN will now encompass 76 hospitals in nine states. By 2020, it expects to include one million patients with full clinical, imaging, laboratory and significant molecular profiles.

“Baptist Health is excited about the opportunity to be a member of the Guardian Research Network," Timothy Jahn, chief clinical officer of Baptist Health, said in the release. "Participation in GRN offers Baptist cancer patients a personalized approach to the care and treatment of their disease in their own communities,”

GRN collects data from "hundreds of thousands of patients'" electronic medical records and stores it so that they can evaluate and analyze it, which results in "bringing cutting-edge therapies specifically targeted to each patient's cancer" says the release.

Following strict HIPAA privacy regulations, GRN uses this data to identify patients who are eligible for clinical trials.

"This rapid patient-to-trial identification process will significantly reduce the time it takes to enroll a patient in the most advanced clinical trials available," says the release.

Electronic health records are here to stay, but continue to have growing pains; some providers say they're not paying off yet

While the ongoing transition to electronic health records promises to bring revolutionary advances in health care, it hasn't been cheap or easy, Josh Shepherd reports for The Lane Report.

In 2004, President George W. Bush set the goal of implementing electronic health records by 2014, and the economic stimulus package of 2009 provided financial help and incentives to meet this goal.

Kentucky established the Kentucky Health Information Exchange (KHIE), a central resource to help hospitals and physicians implement EHR technology and share patient information with other providers, which Kentucky health care IT professionals proudly told Shepherd showed great foresight. And four years ago, Kentucky became the first state to issue incentive payments for meeting the federal standards for meaningful use of EHRs.

As defined by HealthIT.gov, meaningful use requires users to improve quality, safety, efficiency and reduce health disparities; engage patients and families; improve care coordination, and population and public health; and maintain patient information privacy and security.

These goals are meant to be reached in stages. As providers demonstrate they have completed each stage, they earn incentives and avoid penalties.

However, at least two years away from meeting all of these goals, many physicians and those same proud IT professionals, have voiced "great dissatisfaction with current EHR systems and the priorities the federal Centers for Medicare and Medicaid Services dictates to the developers," Shepherd reports.

One of the greatest concerns of providers is the great cost of implementing an EHR system and the added cost of remaining compliant. Dr. David Bensema, chief medical information officer at Baptist Health, and Cheryl Brown and Dr. David Danhauer, information technology leaders at Owensboro Health, readily attest to this, Shepherd reports.

"Bensema and Danhauer each estimate their respective health-care systems to date have invested well over $100 million on software and third-party packages. Costs soar into the hundreds of millions when factoring in the time to orient physicians and allied personnel to the program interfaces, reporting mechanisms and added procedures to follow, Bensema said," Shepherd writes.

And while the federal and state meaningful-use payments are considered "valuable," they don't "come close to the expenses hospitals and medical practices have incurred trying to implement EHR to proscribed federal standards," Bensema told Shepherd.

"As of Oct. 1, the Kentucky program has made 4,860 payments totaling $200.2 million to providers, according to KHIE, and federal meaningful-use incentive programs and the CMS have injected another $337.6 million into Kentucky," Shepherd reports. That totals $537.8 million.

Nationally, CMS has spent more than $30 billion in incentive payments, Lexington physician Steven Stack, president of the American Medical Association, told Shepherd.  The writer puts that into context: "Over that same time period, the U.S. health system is estimated to have spent close to $9 trillion.”

Despite the great expense and many frustrations involved with implementing EHRs , most providers support them and recognize their potential value in health care. “The majority of physicians do not want to go back to paper records," Stack told Shepherd.

But providers say CMS is trying to accomplish too much too fast, without assessing the success and failures of the first phase before moving onto the second, and the current cost of compliance outweighs the current value of the system. Providers say they need a system that doesn't require so much data entry that it takes away from patient care, that has interoperability between systems; and and EHRs that are more user friendly, like smartphones.

Stack has presided over a series of online AMA-sponsored town hall meetings titled "Break the Red Tape" to address these issues by gathering feedback from physicians regarding the current state of EHR technology.

“No one is arguing that meaningful-use objectives aren’t worth achieving,” Stack told Shepherd. “But after creating Meaningful Use Stage 1 out of whole cloth, Stage 2 was initiated before there was any critical evaluation of how Stage 1 was working. And CMS has chosen to continue down this pathway without any attempt at course corrections based on feedback from EHR’s primary users.”

Some physicians have expressed their frustrations by dropping out of the Meaningful Use program during implementation of Stage 2, Stack told Shepherd, willing to accept the penalty because it's more affordable than trying to keep up.

Danhauer expressed concern that the current meaningful-use standards will contribute to the physician shortage in Kentucky by pushing out experienced physicians in their 50s and 60s by making them change their entire way of working. He said the standards need to be modified and their time frames relaxed.

It is difficult to measure the potential value of EHRs, Shepherd writes. Although Baptist Health has projected it could save a minimum of $18 million annually after EHR is implemented and refined, “That figure was on the low end of the scale,” Bensema said. “I believe it’s likely to be much more.”

Despite these uncertainties, "Kentucky hospital systems are moving forward with ambitious plans to introduce full electronic connectivity and shared data under one system," Shepherd writes.

By 2017 Baptist Health hospital and all of its affiliated physician practices will be functioning under a single integrated EHR system,  Danhauer told Shepherd.

Brown said Owensboro Health can now transmit public health data to two organizations, since it successfully attested to Meaningful Use Stage 2.

Shepherd writes, "The resulting ability to organize and share patient history, imaging and medication information among hospital services, primary care providers and specialists, Danhauer said, will have an enormous impact on raising patient care quality in Kentucky by reducing medication errors and unnecessary duplication of services." Brown said EHRs also "enable public health entities to better track trends in diagnoses and disease."

Predicting that patients will drive health care's embrace of EHRs, as many already have at Owensboro Health, Danhauer said, “There is a generation of people who are accustomed to conducting business and managing finances electronically. They want their health information, lab results and X-rays in front of them with their doctor or surgeon answering their questions.”

Patient portals at Leitchfield hospital are breached in cyber attack; officials say it did not involve any data in state system

By Melissa Patrick
Kentucky Health News

Twin Lakes Regional Medical Center's patient portals were the target of a sophisticated cyber attack earlier this year, which may have breached protected patient health information, reports The Record, a Leitchfield newspaper.

The cyber attack was made on one of the Kentucky Health Information Exchange's patient portal vendors, NoMoreClipboard. KHIE patient portals are secure, online websites that give patients access to their personal health information.

"The NoMoreClipboard breach only affected one hospital, Twin Lakes," Beth Fisher, spokeswoman for the Cabinet for Health and Family Services, said in an e-mail. "The breach affected the patient portal maintained by NoMoreClipboard, not KHIE. No information from KHIE was breached or accessed."

KHIE provides a common electronic information infrastructure that supports the exchange of electronic health information among healthcare providers and organizations throughout Kentucky. It contracts with many different vendors to provide this service.

The security notice from NoMoreClipbard said the data that might have been compromised are: an individuals’ name, home address, Social Security number, username, password, spousal information (name and potentially date of birth), security question and answer, email address, date of birth, health information, and health insurance policy information. The newspaper says that no financial or credit card information was compromised because this information is not collected or stored.

The hospital made the announcement on July 27 and asked patients to not call the hospital "since the breach did not involve any information stored by the hospital or by any local doctor's office," the newspaper writes.

As of July 30, the hospital could not determine the number of people affected by the breach, but said "It should be kept to a minimum since the system was only recently put into place," the newspaper reports.

NoMoreClipboard began contacting affected individuals on June 2, according to the online security notice. It has also established a confidential, toll-free hotline to answer any questions. The hotline is available Monday through Friday, 8 a.m. to 8 p.m. CDT and can be reached at 866-328-1987.

NoMoreClipboard is offering credit monitoring and identity protection services to affected individuals, free of charge, for the next 24 months. Click here to see the security notice sent to its clients.

Dr. Steven J. Stack of Lexington is sworn in as 170th president of the American Medical Association

Dr. Steven J. Stack, an emergency physician practicing in Lexington, was sworn in as the 170th president of the American Medical Association, the nation’s largest physician organization.

Dr. Steven J. Stack

He is the organization’s youngest president in the past 160 years and is the first board-certified emergency-room physician elected to the post.

Stack says he will focus his tenure on advancing the AMA’s three strategic areas: improving health outcomes for those with pre-diabetes and hypertension; accelerating change in medical education to ensure physicians are prepared to meet the needs of a 21st century health care system; and enhancing physician satisfaction and practice sustainability.

"I am honored and privileged to be named president of an organization that is dedicated to the art and science of medicine and the betterment of public health and a profession that is working to improve the health of our nation," Stack said in a press release. "I look forward to serving on behalf of America’s physicians to not only create a brighter future for the medical profession but a healthier America one patient at time, one family at a time and one community at a time."

Stack gained national recognition for his expertise in health information technology while serving as chair of the AMA's Health Information Technology Advisory Group from 2007 to 2013. He has also served on multiple federal advisory groups for the Office of the National Coordinator for Health Information Technology and as Secretary for eHealth Initiative, a non-profit multi-stakeholder organization committed to advancing health care through health information technology.

In Kentucky, Stack has served as medical director of the emergency departments at Saint Joseph East in Lexington and Saint Joseph Mount Sterling, both part of KentuckyOne Health. He was also previous medical director of the emergency department at Baptist Memorial Hospital in Memphis, Tenn.

Stack was elected to the AMA Board of Trustees in 2006. In the last eight years, he has served in many leadership positions, including chair and secretary. Prior to his service on the AMA board, he was an elected leader in numerous state, national and specialty medical associations.

He is the second Lexington physician to lead the AMA in three years. Dr. Ardis Dee Hoven, an infectious-disease specialist at the University of Kentucky, led the group in 2013-14.

How has the federal health-reform law changed your care?

Despite the controversy that continues to surround the Patient Protection and Affordable Act five years after its passage, it has probably changed the way your health care is delivered as it drives new models of payment, forces providers to approach care differently, and changes how health care is evaluated, Kavita Patel and Domitilla Masi report for the Brookings Institution.

Here are five ways the authors say that your health care might be different than it was five years ago because of the reform law:

Your physician might be part of a patient care team. New payment models in the ACA encourage an interdisciplinary team-based approach, which evidence shows "can lead to higher quality care and better health outcomes for patient." This approach allows the physician to spend more time diagnosing and devising a treatment plan, while the patient may spend more time interacting with non-physician staff for support care.

Prevention and wellness are more important than ever. The ACA requires health plans to cover all preventive screenings, immunizations and well visits for women at no cost, as part of the minimum benefits required in order for health-insurance plans to participate in exchanges like Kynect. The new payment models also pay physicians who work toward keeping their patients healthy, instead of just treating them when they are sick. " Since the policy took effect in September 2010 it is estimated that an additional 76 million people now receive preventive care," the authors write.

You may have better access to care on evenings and weekends. New payment models are driving this change as practices are often required to offer extended hours to decrease the overuse of emergency departments. Many offices now offer clinical advice around the clock with a clinician who has immediate access to their medical records.

Chances are your health information is being stored in an electronic health record, not a paper file. A separate law encouraged the use of EHRs, but "participation in the new ACA-promoted delivery models is practically impossible" without them. And while EHRs can be used to greatly improve patient care, not all EHRs are created equal and it will take time before patients see seamless integration and exchange between different doctors and settings in "real-time".

You can access care remotely, wherever you are. Doctors are using mobile technology and tele-health in rural and remote areas to provide more efficient care to patients. Insurance companies and employers are beginning to recognize this mode of treatment not only as a way to save money, but to also provide timely access to care, that does not involve the emergency room.

Most Kentuckians don't communicate with doctors electronically; most are confident about access to pricing information for care

Most Kentuckians don't communicate with their doctor electronically, according to the latest Kentucky Health Issues Poll.

The poll, taken Oct.8-Nov.6, found that 73 percent of Kentuckians have not communicated with their doctor using text, email or a website during the last year. A national poll found similar results.

This finding was consistent in all age groups, but there was a difference among socioeconomic groups.

Seventy-nine percent of those whose incomes are 200 percent of the federal poverty level or below said they had no electronic communication with their doctor in the past year, but only 66 percent of those above this level said they had had no electronic contact. In 2013, 200 percent of poverty level was $47,100 for a family of four.

Electronic communication with doctors was most common in Northern Kentucky and least common in Eastrern and Western Kentucky.

The Kentucky Health Information Exchange, the hub that connects participating providers with each other to share health information via certified electronic health records, is now working to connect patients to their electronic health records via a pilot program.

Research has found that patients who are better informed about their health and health care cost are more engaged with their health, according to the release.

Patients at UKHealthCare who have access to their "patient portals" seven days after discharge are an example of how few Kentuckians are engaging with their health care provider via electronics.

“About 8 to 10 percent of hospitalized patients look at their patient portals, of our inpatients,”Dr. Carol Steltenkamp, chief medical information officer at UKHealthCare, said in a phone interview “We would love for that to increase.”

Steltenkamp said that patients often don't understand how to use their portals and that the hospital is working diligently to educate them.

The poll also found that most Kentuckians think they can find out what doctors charge for treatments and procedures if they need this information, finding 36 percent extremely or very confident that they could find out how much treatments and procedures cost; 34 percent moderately confident and 28 percent not too confident or not confident at all. These answers did not vary by income, age or region.

The poll is conducted by the Institute for Policy Research at the University of Cincinnati and was funded by the Foundation for a Healthy Kentucky and Interact for Health, formerly the Health Foundation of Greater Cincinnati. It surveyed a random sample of 1,597 adults via landline and cell phone, and has a margin of error of plus or minus 2.5 percentage points.

AMA president-elect, from Lexington, talks with KET host about the myriad issues facing his profession and its patients

Steven J. Stack

The new president-elect of the American Medical Association, Dr. Steven J. Stack of Lexington, covered a range of topics with Bill Goodman on KET's "One to One" in December, including the AMA's advocacy role, health information technology, improving health disparities in Kentucky and medical liability reform.

Stack, an emergency physician in Lexington, told Goodman that his experience as an emergency room physician would bring a unique perspective to his role as AMA president because he has seen first-hand how many people don't have health insurance and therefore a lack of access to routine care.

"As an emergency-room physician, it has been for me a personal hope and aspiration and a great joy to see that we are making strides finally to improve American's access to care because we know that those without access to health insurance and support live sicker and die younger," Stack said. "And that's a tragedy that we should not stomach easily or tolerate in this nation."

Not only is Stack the first board-certified emergency physician elected president, when he takes office in June he will be the youngest person to lead the AMA, the nation's largest organization for physicians. He is a longtime member of the organization and has held many leadership positions. He is the second Lexington doctor in three years to hold the office. AMA's immediate past president is Dr. Ardis Dee Hoven, an infectious disease specialist at the University of Kentucky.

Stack said the AMA as an association is non-partisan and works with people in both partie "to advance policies that we hope will improve patient care and the practice of medicine." That being said, he then said he fully recognized the role of politics in health policy and said he will, "have to advocate strenuously at times for those policies that we think will be helpful."

He talked about the privilege of being an advocate before Congress, federal agencies and the state legislature. "It is an incredible privilege and it is one that I take very seriously," he said.

Stack headed the AMA’s Health Information Technology Advisory Group from 2007 to 2013 and is a member of the federal advisory groups for the Office of the National Coordinator for Health Information Technology.

"Healthcare is one of the last big sectors in the U.S. economy to go digital in its management of information. And there are good reasons for that delay," Stack said. He listed several reasons: the complexity of health care, the varying needs of different types of health-care facilities, maintaining patient privacy, continuing technological barriers, and politics.

Asked why it is taking so long to make advancements with electronic health records, Stack blamed "policy issues, differences in opinion, protecting privacy, a variation across all 50 states and layering on top of that different federal requirements." But he added, "We will get there."

Stack suggested that focusing on improving health outcomes, which is part of the AMA strategic plan, would ultimately help improve many of the health disparities that face so many Kentuckians.

Asked about the continued calls by some to repeal the Patient Protection and Affordable Care Act, Stack said the time to quit arguing about it is long past, it is "the law of the land" and recent polls show that the many people who have received insurance through the PPACA are happy with it.

"It is here to stay and we need to  get to work on fixing the things that have to be fixed," he said.

At the same time, the AMA firmly supports medical liability reform, which was not included in the reform law. Stack told Goodman that this reform is not only important for physicians, but also patients. "Only one in 100 cases actually prevail against the physician at trial," he said, and "Nearly 90 percent of cases are either dismissed or dropped, closed or settled with no payment from the physician to the plaintiff. It is clearly not helping the patients."

He called for "a rational system" that appropriately compensates patients who are "inappropriately harmed" and treats physicians fairly, while not making a "small number" of lawyers rich.

Asked what his overarching goal as president of the AMA would be, Stack said, "I would really like to see all Americans have access to high quality, reliable health care that is affordable and within their means. So the AMA and I will work diligently to that end and it is a great privilege to do that."

Click here to view the program.

Women leading Kentucky health: State health commissioner sees 'stars aligned' for Kentucky to finally get healthier

Health Commissioner Stephanie Mayfield Gibson

This is the third in a series of stories about four high-ranking female state officials who have guided the state's embrace of the Patient Protection and Affordable Care Act.

By Melissa Patrick

Kentucky Health News

“The stars have aligned” and Kentucky has at last “created an infrastructure” to make the state healthier, says Dr. Stephanie Mayfield Gibson, commissioner of the state Department for Public Health.

“What a great time to be in my position,” Mayfield said in an interview, in which she enthusiastically ticked off a list of aligned stars:

• Her bosses, including the governor and lieutenant governor, who are “extraordinarily supportive of health care;”
• The expansion of the federal-state Medicaid program to households with incomes up to 138 percent of the federal poverty level;
• The Kentucky Health Benefits Exchange, branded as Kynect, where Kentuckians sign up for Medicaid or subsidized private insurance;
• The Kentucky Health Information Exchange, an electronic network that makes a wide range of health information easily available; and
• Programs that enhance the quality of care to get better outcomes and decrease costs, such as the programs to stop over-use of emergency rooms.

Mayfield says her top priority is to decrease exposure to tobacco, because so many of Kentucky’s health issues are related to its most famous crop. About 28 percent of Kentuckians smoke, and “The single most important factor that negatively impacts the health of the commonwealth . . . is exposure to tobacco smoke,” Mayfield said. “I want people well.”

She said Kentucky must also address the epidemic of painkiller abuse, which has made it one of the top three states in deaths related to abuse of opioids; and obesity, which is connected to cancer, diabetes and cardiovascular disease. Kentucky ranks in the top five in each of those diseases, and is in the top 10 for child and adult obesity.  

“Who wants the reputation for being number one in cancer deaths?” Mayfield asked. “We know we can do better. These are winnable battles.”

These and other issues are included in Kentucky Health Now, a plan Gov. Steve Beshear has set forth to improve the health of Kentuckians, with specific goals to be reached by 2019, the end of the next gubernatorial term. Beshear’s term ends in December 2015.

Mayfield is vice-chair of the team overseeing the effort, led by Lt. Gov. Jerry Abramson.  She seems to have the full confidence of Audrey Haynes, the secretary of the Cabinet for Health and Family Services, who lit up when asked about her, but Haynes said she had to make sure that Mayfield, a pathologist who ran the state health lab for seven years, was cut out to be the state’s top doctor.

“It’s a job where … you have to kind of have a better understanding of politics,” Haynes said.  “But I wanted her to rise above all that because she is the public health commissioner. Hers is more about the science.  I need her to be honest and tell the truth.”

Haynes said she told Mayfield, “You are going to tell people what they don’t want to hear sometimes, but always stick with science.  You have to rise above the rhetoric, no matter what.”

“And so I recommended her to the governor and they also fell in love with her.” She became commissioner on Oct. 1, 2012.

Kentucky’s health problems have mounted for decades, but Mayfield is optimistic that they can be overcome because of the Medicaid expansion and increased access to health insurance under the federal health-reform law. Thousands of people have sought care for problems that went untreated because they had little or no money or no insurance.

The federal government is paying the entire cost of those newly eligible for Medicaid until 2017, when the state will begin paying 3 percent, rising to the law’s cap of 20 percent in 2020.  Republican legislators and candidates for governor have voiced concern about the state’s ability to pay its Medicaid bills.

Mayfield said the state is working on controlling costs, through the managed-care system that began in 2011.  One target of cost control is the “super-utilizers” of emergency rooms, or those who come to hospital emergency departments 10 or more times per month.

Mayfield, who was put in charge of finding a way to reduce super-utilizers, said 80 percent of them have mental-health issues, so she is working on the problem with Medicare, the state Department of Behavioral Health and Kentucky’s three medical schools. Kentucky is one of six states accepted into the National Governors Association Policy Academy to address super-utilization.

Dr. William Hacker, who preceded Mayfield as commissioner, said her broad training and deep experience in the department uniquely qualified her to succeed Dr. Steve Davis, who was interim commissioner after Hacker retired.

“She is multidisciplinary and thinks beyond the public-health world,” Hacker said. “She has done an excellent job.”

Mayfield, who has been nationally recognized for her contributions to the state’s electronic health information exchange, also stresses the importance of using technology to improve the health of Kentuckians – especially those who live in rural areas, far from specialists.

Mayfield describes her style of leadership as one of action.  “If we say we are going to do something, then let’s build that infrastructure and let’s get it done,” she said.

Hacker said, “Dr. Mayfield is a thoroughbred.  She is on the go at 90 miles per hour.  She is focused on accomplishing goals.”

Haynes said Mayfield “led massive change at the lab” and knows “how to cajole and support and lead” – and when to be firm. “There are times you have to stick to your guns. You have to choose sort of your poison and you have to say ‘I’ll give you this, but I’m not giving this.’ I needed somebody that didn’t feel the political pressure to give in, and that would stick with it. And really just be a great public face of public health.  And she is all of that.”

UK hospital tells 1,079 former patients that a laptop computer with their medical records was stolen in early February

The University of Kentucky reported Wednesday that personal health information of 1,079 people who had been patients at its hospital was on a laptop computer that was stolen in early February.

UK HealthCare said the computer, which was password-protected, belonged to one of its pharmacy billing management vendors. The computer contained dates of birth, medical records and perhaps some patients' insurance carriers and ID numbers, but not Social Security numbers or bank information, UK said.

"We have no reason to believe at this time that any data has been compromised, but under federal privacy regulations we are required to notify people whose information was on the computer in question," UK spokesman Jay Blanton said. "We are also notifying those individuals directly about what has occurred. In that communication, we provide information about where people can contact UK HealthCare for further information." For coverage from WKYT-TV, click here.

In wide-ranging interview, secretary says her state health cabinet is a national leader in guarding the privacy of electronic data

Despite concerns elsewhere about the privacy of personal health information, Kentucky's top health official says her agency is one of the best in the nation at protecting and managing such data.

Audrey Tayse Haynes, secretary of the Cabinet for Health and Family Services, talked about information technology and privacy in an interview with Mark Green, editor of The Lane Report, a Lexington-based business publication. She credited her cabinet's information-technology department and its good record on privacy.

Secretary Audrey Haynes

"We have an extraordinary IT department at this cabinet," Haynes said. "They really are stellar. I’ve worked at national organizations, in the federal government, and of course at the state level, and we have as good an IT department, if not better, than any I’ve seen. That gives us in-house expertise and also, obviously, they can contract for further expertise."

She added, "This cabinet has a long history of maintaining people’s private information because of Medicaid and food stamps and many other programs that we run here. Last year millions of dollars were collected for Kentucky’s kids through court-ordered child support that runs through this cabinet. We have very strict requirements, both at the federal and state levels, and we take privacy very seriously. Our IT department and others plan for it, and we’re alert to it all the time."

Haynes said Kentucky is also a national leader in helping health-care providers share electronic health records, through the Kentucky Health Information Exchange, with more than 2,000 participating and getting more than $144 million in federal incentive payments. The information exchange "is nationally recognized as being in the forefront for the exchange of health information records," Haynes said. "We are one of the most progressive in the nation."

She noted that the cabinet also runs KASPER (the Kentucky All Schedule Prescription Electronic Reporting) system, which doctors and medical professionals check before prescribing controlled substances to prevent drug abuse. A 2012 law cracking down on prescription painkillers required prescribers to use the system, and it now has more than 24,700 users, Haynes said. "KASPER is a very complex system to maintain," she said, "but it is keeping Kentucky at the forefront nationally as far as helping to curb the prescription drug problem in our state.

Green and Haynes touched on many subjects in the interview, which as published runs almost 3,000 words. She said the state's health-insurance exchange, Kynect, has been successful also because of its executive director, Carrie Banahan, who "has a long history of experience with insurance, with Medicaid and with management. That’s critical. And we made it not just Carrie’s project but a Cabinet project. Then we were able to get a great company that was very committed to the success of this in Deloitte" Consulting, which built the system. "Finally, we kept it simple. We knew we could make improvements as the months and years went on. We didn’t try to be too fancy right out of the gate. We knew that it needed to work well when it was launched – that was more important than making it the fanciest online system right away."

Haynes concluded, "When I came back from Washington, D.C., to take this job, people who know me and know this cabinet were very surprised, but I’ve never regretted it. I believe in public service as well as in the role of the private sector, and this has been a dream job for me because I’ve had an opportunity to work making good policy. I’ve had some pretty neat dream jobs in my career, but this is certainly going to be the topper. Few of us ever have an opportunity to say that we have done something that can truly have an impact and be part of something that’s going to have an impact for many, many years. I think about that all the time. I wouldn’t want to be anywhere else." (Read more)

Medical identity theft increasing; survey says 43% of leaks involve medical records

Modern technology has brought about an increase in identity theft and lately in a particularly dangerous form: medical identity theft. According to a survey conducted by the Identity Theft Resource Center, 43 percent of all record breaches in personal information in 2013 involved health records . That's more than those involved with banking and finance, education, the government and the military, Michael Ollove writes for Stateline.

Medical identity theft is deceptively obtaining another person's personal information—such as name, Social Security number and health-insurance number—to get medical services, reimbursements or prescription drugs. "Medical identity theft is a growing and dangerous crime that leaves its victims with little to no recourse for recovery," said Pam Dixon, World Privacy Forum's founder and executive director. "Victims often experience financial repercussions and worse yet, they frequently discover erroneous information has been added to their personal medical files due to the thief's activities."

The Patient Protection and Affordable Care Act has caused even more concern about the privacy of medical information. Some people worry that online marketplaces could compromise confidentiality, and with the increased push for digitized medical records comes questions about the level of security of the computer networks. "Edward Snowden, the former National Security Agency contractor who has disclosed the agency's activities to the media, says the NSA has cracked the encryption used to protect the medical records of millions of Americans," Ollove writes.

According to Sam Imandoust of the Identity Theft Resource Center, thieves can obtain medical information by stealing laptops or hacking into computer networks. "With a click of a few buttons, you might have access to the records of 10,000 patients. Each bit of information can be sold for $10 to $20," he said. Over half of the security breaches result from a stolen electronic device, 20 percent result from a person's obtaining unauthorized access to information or giving it to someone who shouldn't have it and 14 percent result from hacking.

The Health Insurance Portability and Accountability Act and the Health Information Technology Act are the two federal laws that mandate the confidentiality of medical records. A business, institution or provider can be charged between $100 and $50,000 for failing to meet privacy standards, and a person who violates HIPAA could be charged a fine of $50,000 and serve up to a year in prison.

Even if the breach is discovered, that doesn't undo all the damage, Ollove writes. "It's almost impossible to clear up a medical record once medical identity theft has occurred," said James Pyles, a Washington, D.C., lawyer who has dealt with health issues for more than 40 years. "If someone is getting false information into your file, theirs gets laced with yours, and it's impossible to segregate what information is about you and what is about them." The U.S. has "a regulated industry that is saddled with laws with so many loopholes that they don't know what they are responsible for and a public that doesn't believe their health information is being protected." (Read more)

Patient care, hospitals' future at stake as smaller hospitals lag behind larger ones in electronic health records

Electronic health records have been hailed as a great boon to patients and health-care providers, but the next phase of their implementation poses obstacles for many small, independent hospitals, Jennifer Bresnick reports for EHR Intelligence.

Most hospitals have implemented a basic EHR system, but costs have discouraged them from purchasing the advanced capabilities called for by the federal health-reform law that allow them interact with other systems to share and analyze data and use clinical data warehousing, population health management and quality benchmarking. Not having these advanced capabilities may hurt these small hospitals in the long run, Bresnick reports.

“The larger hospitals are doing well,” Lorren Pettit, vice president of market research for HIMSS Analytics, told Bresnick. “But we have seen that where the applications are behind the curve tends to be in the smaller hospitals. There really is a correlation between hospital size and the breadth and depth of their applications—how advanced their infrastructure is.”

Pettit said he is concerned about critical access hospitals, those that limit their beds and procedures in return for slightly larger Medicare and Medicaid reimbursements. Kentucky has 29 such hospitals. He fears they are getting too far behind the larger hospitals in implementing the advanced capabilities of the electronic health records, creating a situation where there is a difference in the quality of care between urban and rural areas.

Pettit said the most successful critical area hospitals are those that are part of a larger system that helps them with their technology. He told Bresnick, "Being an independent, small hospital . . . there’s just too much at stake and too much investment, and it’s going to impede a lot of these hospitals from moving forward.”

Physicians say they dislike regulations on use of electronic health records, but they don't want to go back to paper records

Doctors say use of electronic health records is one factor contributing to physician dissatisfaction because it interferes with patient care, says a new study.

Surveyed physicians blame EHRs for reduced quality of care, saying that their daily interaction with "clunky" EHR systems contributes to their dissatisfaction, which is closely linked with their ability to provide quality care, reports Chris Kaiser of MedPage Today. The results were published in a study by the RAND Corp. and commissioned by the American Medical Association.

Physicians said the cumulative burden of rules and regulations affecting clinical practice, including “meaningful-use” rules for EHRs, also detracted from professional satisfaction, says the report brief. These rules were created by the federal Centers for Medicare & Medicaid Services; providers must certify that they are “meaningfully using” their EHRs by meeting established thresholds in order to qualify for the program's financial incentives. If providers accepting Medicare do not qualify by 2015, their Medicare payments will be reduced by 1 percent each year, says HealthIT.gov.

Despite their dissatisfaction with the regulations, physicians said they approved of the concept of EHRs, saying that their use has numerous benefits, including being able to remotely access patient information and improving in-practice communication, says the report. Only 20 percent of physicians said that practices should return to paper documentation.

“Physicians believe in the benefits of electronic health records, and most do not want to go back to paper charts,” said Dr. Mark Friedberg, a natural scientist at the RAND Corporation, in a news release. “But at the same time, they report that electronic systems are deeply problematic in several ways. Physicians are frustrated by systems that force them to do clerical work or distract them from paying close attention to their patients.”

The problem is that many EHR programs aren't user-friendly. This problem should be addressed, says the report, to ease physician workflow and free up time for the physician to spend with the patient. Here are some of the complaints physicians had about EHRs:

Time-consuming data entry 

User interfaces that do not match clinical workflow 

Interference with face-to-face patient care 

Information overload 

Lack of health information exchange between EHRs 

EHRs are expensive, threatening practice finances

Understanding physicians' professional satisfaction is important because better patient care is a potential "downstream" benefit of satisfaction. The researchers said knowing reasons for dissatisfaction can lead to targeted interventions to address the issues,says the news release.

"Aside from viewing better patient care as a potential consequence of better physician professional satisfaction, it may be useful to think of physician dissatisfaction, when it is caused by perceived quality problems, as an indicator of potential delivery system dysfunction," says the report.