20
Extending EHR Access to External Physicians
Joan E. Topper and Kathleen M. Dean
165
Introduction
One of the most important potential benefits of an EHR is improved communication among providers, outside as well as inside the organization. This chapter presents our experience with a variety of methods for extending EHR access to affiliated providers, whom we define as any provider who serves on the staff of our community hospital, who refers patients to us, or to whom we refer patients.
In 2000, a survey of affiliated physicians indicated that more timely and complete clinical communication is one of their three most important criteria for referring patients to another CDO. This prompted us to look for ways to extend EHR access to them. While existing communication channels (e.g., U.S. mail, fax, telephone, face- to-face conversations) are each useful, the EHR and Web applications can deliver patient information to affiliated providers more rapidly, securely, reliably, and cost effectively.
We have developed three main approaches to providing information to affiliated providers. First, we created a Web portal containing episode-specific information. Next, we provided affiliates access to the complete EHR. Most recently, we automated the routing of electronic and transcribed patient encounter documentation.
Organization
To lead this effort, we hired an e-Health Director with a mandate from executive leadership to coordinate the efforts of clinical operations, marketing and IT. To gain guidance and support, the director created a steering committee comprised of a vice-president of clinical operations, the Director of marketing, the CIO, the CMIO, the Director of EHR projects, the Director of Web Services, and the Director of Patient Safety.
Needs Assessment
A 2000 survey indicated that these are the six online services that are most attractive to our affiliated physicians:
1. Access to the patient’s EHR
2. Access to electronic medical reference information
3. Access to continuing medical education (CME) courses
4. Automatic notification of significant patient events (e.g., discharge summaries) 5. Easier communication with Geisinger physicians
6. Referral appointment scheduling
Phase 1: General Information
In May 2001, we implemented the first phase of the e-health project, an affiliated- physician section on our external Web site (http://www.geisinger.org).
The section contained several features:
• CME information
• Schedules of specialists’ availability at outreach clinics
• Patient education materials
• Healthcare news
• Information about Geisinger clinical services
As we expected from the survey, these resources did not provide enough value to motivate much use (about 200 site visits a month).
Phase 2: Event-Based Information Reporting
Next, we added core information (date of admission, patient location, demographics, insurance, date of discharge and discharge summary) on patients seen at a Geisinger clinical facility in the last 90 days. Software scans the EHR database each night for new patient information (primarily office visits or hospitalizations) and posts it to the secure Web account of the patient’s referring and primary-care physicians. While this section of the portal does not provide all of the information in the patient’s EHR, affiliated physicians find it useful—particularly since it streamlines existing paper workflows, rather than requiring new ones.
Affiliated providers report these benefits:
• Rapid notification of patient admission and discharges
• Simplified navigation (since only recent records are included)
• A convenient list of patients in the hospital (by provider and by practice)
• Patient consent is not needed since the provider sees only information related to care they ordered or referred the patient for.
Portal Access
The portal’s target market is physicians, but it is usually the staff who access medical records to prepare them for physician use. We developed a security system that manages the access given to physicians, mid-level providers, nurses, billing clerks and other office staff.
When a physician requests access to the portal, we ask them to designate an indi- vidual (usually the office manager) as the practice’s contact person. This individual is responsible for identifying other staff members who need access. Each staff member signs an individual user agreement and receives a unique ID and password that she is
required to change at a set interval. (This enables us to create HIPAA-compliant records of access.) Physicians and practices agree to notify us when a staff member leaves.
If one physician in a practice has a care relationship with a patient, any authorized person from that office may access information. This allows physicians to cover each other during absences and gives office staff the access they need to coordinate care.
Phase 3: Single-Patient EHR Access
In the third phase of the project, we used one of our EHR vendor’s products (EpicLink®) to provide affiliated physicians access to the full EHR of patients. We began by piloting the service in one practice in 2001.
Physician access to the entire EHR has the potential to improve patient safety (for instance, by ensuring that the patient’s full medicine list is available) and healthcare efficiency (by recording that the patient’s latest tetanus shot was four years ago). It also has the potential to compromise patient confidentiality (e.g., the orthopedic surgeon treating his neighbor’s ankle fracture sees that the patient has a history of depression).
Because we cannot protect patient confidentiality by limiting this global access to the EHR, we require the requesting physician to send us the patient’s written author- ization before allowing access. These authorizations are valid for three years. (In feed- back groups, patients unanimously support a longer interval, 20 years or more. As we gain more experience with privacy regulations, we plan to extend the interval.)
The requirement that each patient authorize each affiliated provider’s access – par- ticularly given the accompanying 24-48-hour delay until access activation – is a major disincentive to provider use. Most believe that since they have a direct care relation- ship with that patient, they should be able to access the patient’s information without specific authorization. This feeling is reinforced by the fact that they receive much of the same information (test results, notes, letters) on paper without an authorization.
Since the affiliated physician access module of our EHR simply provides a secure Web-based view into the EHR, technical set-up was relatively simple. The one security issue that we needed to address was the fact that the original version of the product accessed the production EHR. Even over a secured Internet connection, this posed a small, but unacceptable risk of corrupting the EHR’s database. We resolved the issue by installing a shadow server to which this application, as well as the patient-access application, is directed.
Each practice’s implementation required a network generalist (see Chapter 13) to visit the practice and load the client software on all the computers that would be used to access patient records.
The practices agreed to the following conditions:
• To provide computers and connectivity to the Internet (usually a dedicated phone line).
• To use 128-bit encryption.
• To have “cookies” turned on (a requirement for the software to work).
• To sign a confidentiality agreement. Each user signs an individual use agreement, and each is assigned a unique user ID and temporary activation password.
Access to the patients’ entire EHR can make locating information a challenge for inexperienced users. Physicians and their staff may need extensive (eight to 16 hours) training to use the EHR effectively. Because they use the EHR only intermittently,
learning will be slow and hard to consolidate. For these reasons, many affiliated physi- cians prefer access to the smaller (hence, more navigable) event-based data set.
Phase 4: Streamlined Document Distribution
Streamlined document distribution is a feature we built into our EHR.When a provider finishes documenting a patient encounter in the EHR, he can invoke a screen in which to indicate providers he wants to receive copies of the note. The patient’s primary-care physician and referring provider are automatically included—if that information was recorded when the patient checked in. There is also a pick-list of providers who have previously received communications regarding the patient. At the next level of gener- ality, any provider in the region can be selected by pattern matching. Finally, a free- text box allows entering the name and address of a provider who is not presently in the database. Overnight, the application sends the note to the receiving provider’s preferred address (fax, U.S. mail, or e-mail).
As usual, the technical set-up was the easiest part of the project. Verifying every regional physician’s address, telephone number, fax number and preferred communi- cation channel took hundreds of person-hours. As a next step, we are considering adding payers to the database, to streamline provider communication with them.
Information Security
We use the Web-based access-management software and methodologies described in Chapter 19, to manage access for external physicians and practices.
Physicians can access episode-based patient records and the full EHR of individual patients from their office. However, many need at home access. This requires an addi- tional level of security: two-factor authentication. Two-factor authentication requires something the user knows (her password) and something she has (in our case, a key fob that displays a numerical password which is synchronized with the sign-on server).
We use fobs provided by our IAM vendor.
Selling It
The first rule of selling is to know your audience. The CMIO presented the portal at a medical staff meeting of our community hospital, which was attended by about 30 affil- iated physicians. Each attendee received a fact sheet and the opportunity to sign up at the meeting or to call and sign-up. We received only two responses. The next month, we sent a letter to the office managers of affiliated physicians’ practices (with the same invitation) and signed up 50 practices in 90 days. A year later (2004), we are serving 148 practices
Keys to Success
1. Design a comprehensive security plan early and build your services consistent with that plan. Consider single sign-on software.
2. Understand affiliated providers’ needs and check your understanding frequently. An internal physician advisory board can aid with this understanding, particularly if some members are (or recently were) affiliated providers.
3. Careful coordination between clinical operations, IT and Marketing is remarkably productive.
4. Remember that electronic communication is only one communication channel among many. Telephone, US mail, fax and face-to-face communication continue to be the preferred channels for many providers. Give them information the way they want it. And remember that preferences will be changing rapidly over the next decade.
Part Four
Summary and Prospect
