Feds criticized for lax oversight of health IT

In 2013, a mother brought her 2-year-old child with a broken leg to Sinai Hospital's emergency department in Baltimore. She told the admitting nurse her toddler weighed 35 pounds. The nurse hand wrote “35” onto a form without noting whether it was in pounds or kilograms.

When the information was copied into the child's electronic health record, the software automatically interpreted the weight in kilograms—its default setting—or 77 pounds. The baby was prescribed more than twice the normal dose of a drug at discharge.

Only hours after she and her child returned home, the woman called 911. Her child had turned blue and slipped into a coma. Emergency medical technicians raced the child back to the hospital, where the child was revived and admitted, according to a report filed with the CMS.

The incident prompted the hospital to change its EHR system. Now all scales are set so weights can be measured only in kilograms, and the EHR is auto-populated with the proper figure. “We continuously and vigilantly evaluate our processes, procedures and equipment to ensure the highest level of safety for our patients,” said Barbara Epke, vice president of quality for LifeBridge Health, which owns Sinai Hospital.

Even the most enthusiastic advocates of health IT concede the proliferation of EHRs and other software has introduced new safety hazards into already complex healthcare settings. A 2011 Institute of Medicine report found poorly designed EHRs were causing dosing errors, failures to detect life-threatening illnesses and delayed treatments because of poor human-computer interactions or data losses. In some cases, the errors had led to serious injuries and deaths.

The report called for heightened government oversight of the largely unregulated health IT field. It called on HHS' Office of the National Coordinator for Health Information Technology to play the primary role in ensuring that EHRs and other software are safe, and proposed creating a centralized registry for health IT products where users could report safety problems.

The IOM report also recommended adopting “quality management principles” to ensure health IT products were user-friendly; mandatory reporting of adverse events by software vendors; and creating a National Transportation Safety Board-like agency to use the new centralized database and reporting system to investigate safety problems and make recommendations for change.

Nearly four years later, none of those recommendations has been carried out.

Critics blame a variety of factors. They say ONC has a conflict of interest as it both promotes EHR adoption through federal incentive payments to providers and oversees the safety of those products. They claim software vendors have successfully lobbied to weaken requirements and used restrictive contract clauses to keep problems largely hidden. Critics also suggest the ONC has been encouraged to move slowly by advisory committees led by experts who have financial ties to the industry they are supposed to be regulating.

“Their focus is on getting people to buy and use the software, not to make it usable or safe,” said Ross Koppel, a sociologist who studies health IT at the University of Pennsylvania.

ONC acknowledges gaps in health IT safety reporting but says it is largely powerless to act. “We don't have the authority, we believe, to mandate reporting,” said Jodi Daniel, director of ONC's Office of Policy Planning.

The ONC already requires vendors to list the EHRs that it certifies for purchase under the government's incentive program. But that leaves out parts of health IT, like mobile applications and large swaths of clinical decision support software.

That lack of a comprehensive listing is critical, said Dr. Julian Goldman, the medical director of biomedical engineering for Partners HealthCare in Boston. Listing “allows consumers of a device to report a problem.” Without such reports in a centralized place where they can be indexed, it is almost impossible for authorities to analyze safety-related problems, he said.

The failure to create a centralized registry is the result of a watering-down process that took place after the Food & Drug Administration, the ONC and the Federal Communications Commission convened a work group to formulate regulations in the wake of the IOM report. In August 2013, one of its final drafts stated that “vendors should be required to list products which are considered to represent at least some risk.” It said the requirement should be established “if a nonburdensome approach can be identified for doing so.”

Goldman, who was a member of the work group, criticized that language, saying listing must be required and it must be made nonburdensome. Dr. David Bates, chief innovation officer at Brigham and Women's Hospital, Boston, and chair of the work group, supported Goldman's position, as did all present members of the work group. Yet the original “nonburdensome” language still made it to the final draft.

Bates, who sits on boards or holds equity stakes in a number of health IT software firms, told Modern Healthcare that while he supports listing, such reporting could be quite burdensome for vendors. “There's a clear challenge in terms of managing something like that,” he said, noting any minor change in a software program could entail making a new filing with the government.

But Goldman rejected that argument. “It sounds like overstating the concern,” he said in an interview.

Months later, in April 2014, the federal agencies issued a draft report responding to the IOM and the summer 2013 work group. It cited the “nonburdensome” language and suggested a private entity could manage the list. Vendors, however, balked at any listing or reporting requirements. “We do not believe that there is a clear rationale for formalized listing,” GE Healthcare wrote in a July 2014 comment letter. Siemens, the Healthcare Information and Management Systems Society, and the Electronic Health Record Association expressed similar views.

Public reporting is further hindered by alleged gag orders in EHR contract clauses. These clauses block physicians from sharing screenshots or other information that documents flaws in EHRs. “It's so hard to even find screenshots of this software online,” said Dr. Nick Genes, an assistant professor of emergency medicine at Mount Sinai Hospital in New York.

Dr. Robert Wachter, a professor and patient-safety expert at the University of California at San Francisco, has similar concerns. His new book The Digital Doctor, describes a case of massive overdose of antibiotics administered to a teenager at UCSF Medical Center because of a flaw in the EHR developed by Epic Systems Corp. Wachter said he needed permission from Epic to publish screenshots from the system. That “inhibits the flow of information that might inform others of a dangerous condition that involves their system,” he said.

The ONC has dismissed those concerns. “We don't have any evidence of any contractual restrictions,” ONC's Daniel said.

But in a December 2014 e-mail to the American Medical Informatics Association's Listserv, Dr. Marc Overhage, who was then chief medical informatics officer at Siemens Healthcare, said there was a “single-digit list of vendors who include such language in their contracts.” He didn't identify the firms.

Physicians want to be able to share EHR screenshots because they say EHRs and other health IT software are not user-friendly and their poor design can lead to adverse events. The ONC has tried to address user-friendliness by requiring certifying bodies to conduct usability tests before approving individual software packages.

Those testing requirements are still inadequate, said the University of Pennsylvania's Koppel. “How could it be that a vendor … is not baking this into their process?” Wachter said. “Clearly, the market hasn't forced them to do that.”

The critics say conflicts of interest on some of the ONC's work groups may be holding back a more rigorous approach to identifying and regulating software problems. Bates of Brigham and Women's Hospital, for instance, has been a member of ONC's main health IT policy committee and chairs three health IT work groups.

At a May 2013 meeting of the health IT regulatory work group, Bates disclosed his involvement “with a few startups and I'm on the board of a company named … SEA Medical.” In academic papers published between 2009 and 2014, Bates disclosed an equity stake in clinical-decision-support firm Medicalis Corp., along with unexercised equity stakes in the cloud-based imaging firm Calgary Scientific and clinical-decision-support firm QPID. Bates confirmed those relationships to Modern Healthcare.

During that time period, Bates, who edits the Journal of Patient Safety, also sat on the boards or received consulting fees from 12 groups including startups, established vendors and patient-safety groups. Bates told Modern Healthcare that the Government Accountability Office has reviewed his disclosures and found he had no conflicts of interest.

But Koppel believes conflicts of interest are part of the problem. “The foxes are the architects of the henhouse,” he said. “These committees are dominated by the vendors.”

—With Sabriya Rice