Patient Generated Healthcare Data

Setting up a Patient Generated Health Infrastructure to Facilitate Patient Driven Health Information Economy

Before you ride the bus:

1. Have a clean digital slate | Reduce your digitalb urden: http://geekdoctor.blogspot.co.uk/2016/09/reducing-my-digital-burden.html

Part A - PGHD devices and apps - E-Patient Guddo's ToolBox

Part B - Use Cases | Problem Statements |
Part C - Recommended Appds, Devices, Gadgets, Widgets
PartD - Setting up the stage
Part E - Prinipal Uses of Health Data
Part F - Secondary Uses of Health Data
Part G - Administrative Uses of Health Data
Part H - Chasm between Now and Then  |  Now and LHS
Part I -




Toolkit

Ambient Listening Devices - Amazon Alexa and Google Home

Part C - Recommended Digital Affordances

Devices

Alive Cor | https://www.alivecor.com/ | Buy from  https://www.amazon.co.uk/AliveCor/b/ref=bl_dp_s_web_3531181031?ie=UTF8&node=3531181031&field-lbr_brands_browse-bin=AliveCor |
How it Works - https://www.amazon.co.uk/gp/product/B01A4W8AUK/ref=ox_sc_sfl_title_23?ie=UTF8&psc=1&smid=A1B1FAJ4VGNXBC

Medical Community : for GBP 449 you get 1 Kilo of Alive Cor sensor. Make use of the opportunity and spread awareness amongst your near and dears. Gift one to who you care for.



-------------------------- Externalization of July 22, 2015 Blog ---------------------------

http://geekdoctor.blogspot.co.uk/2015/07/patient-generated-healthcare-data.html

WEDNESDAY, JULY 22, 2015

Patient Generated Healthcare Data

I’ve often written about the IT strategies of Accountable Care Organizations and the need for a Care Management Medical Record which incorporates EHR data, patient generated data, customer relationship management features, protocols/guidelines and a workflow engine.

Although I have yet to see mature products in the marketplace, components are evolving that will fundamentally change the way we deliver care.

People know that I have been very transparent about my own medical history, as described in this Politico editorial.

Here’s how I’m using Patient Generated Healthcare Data in my own care management activities.

For the past 15 years, I’ve had a supraventricular tachycardia (SVT) - an AV nodal reentry issue.    My resting heart rate is 45-50 beats per minute.   On hot days, after I’ve eaten, my heart rate leaps to 170 beats per minute if I exercise vigorously then suddenly stop.     I perform a Valsalva Maneuver  and within a few minutes, my heart rate returns to normal.

I’ve never had any lasting consequences from this SVT.    I could take beta blockers, have an ablation of the ectopic pacemaker in my heart, or just accept that a few times per year I’ll have an arrhythmia.    I’ve chosen the later.

We’ve attempted to capture an ECG of my arrhythmia, but have never been successful.  We’ve tried a stress test, a holter monitor, and other wearable approaches.   It occurs too infrequently to capture.

We now have a solution.   I have attached an AliveCor ECG monitor to my iPhone 6.   The next time I have symptoms, I’ll just hold my phone and capture a perfect Lead I ECG.    From my phone, I can send it after capture to my PCP and the BIDMC electrophysiology expert for review.    It will be reassuring to know that I do not have episodic atrial fibrillation or an unstable ventricular tachycardia.

The cost of this technology is $70 dollars.

Although my body mass index has been constant at 22 for the past 15 years and my caffeine free, low sodium, vegan diet has kept me healthy, my genome is finally catching up to me and I’m starting to experience the essential hypertension (systolic of 140-150) that has been present in generations of both sides of my family.    Diet, exercise, blood pressure monitoring, vitamin D (may be helpful), and salt restriction are reasonable first approaches.   If they fail, then thiazide diuretics, calcium channel blockers or ace inhibitors are the next step, presuming there is no underlying root cause to treat.

As part of my initial assessment, I’m using a Withings Wireless blood pressure monitor with my iPhone 6.

I’m taking readings when I first wake up, before/after the Massachusetts Turnpike commute, at the end of the business day, and before bed.

Thus far, I’m seeing normal blood pressures on weekends after a day of farm work.  I’m seeing 140-150’s after the commute.   In case you’re not familiar with driving in Boston, it looks like this 

After a 12 hour day of meetings, I’ve seen a few spikes to 160, then a return to 130’s by bed time.

All of my measurements are uploaded automatically to the BIDMC electronic health record from my phone within 1 second.

The cost of this level of monitoring is $120.00

I also use a Withings Pulse to monitor my steps/elevation/distance/calories burned/pulse/pulse ox and a Withings Smart Body Analyzer to track my weight/body mass index.

All of this data is displayed with a variance analysis on my phone.

I’m not endorsing these products and have no financial relationship with either AliveCor or Withings.   I’m simply describing my experience that an iPhone 6 can become a middleware hub for healthcare information, enabling me to be the steward of my own data and share it with a healthcare system/provider at minimal cost.

The devices are easy to use and there is end to end data integrity from point of origin (the measurement) to point of use (the doctor).

It’s clear to me that patient wellness (rather than treating sickness) will require more objective and subjective (pain score, mobility, mood) data than we gather today.   EHRs are not yet optimized for incorporating these novel data sources, but the Care Management Medical Record used for team-based coordination of life time care, must leverage the power of new healthcare enabled mobile devices.

Life as a Healthcare CIO: Patient Generated Healthcare Data: I’ve often written about the IT strategies of Accountable Care Organizations and the need for a Care Management Medical Record which incor...





Apple Enters the Healthcare Software Ecosystem

Here's a guest post by Dr. Henry Feldman from BIDMC's Division of Clinical Informatics:

I am writing this from the Apple Worldwide Developer Conference (WWDC) today here in San Francisco, where I got to substitute for John Halamka at the Keynote (now I keep having urges to raise Alpacas); John missed the most amazing seats [front row center!]. There were many, many, many (I can not recall a set of software announcements of this scale from Apple) new technologies that were announced, demoed and discussed, but I will limit this entry to a few technologies that have implications for healthcare.

If you remember the state of digital music, prior to the introduction of the iPod and iTunes music store, that is where I feel the current state of the healthcare app industry is at; there is no common infrastructure between any of the offerings, and consumers have been somewhat ambivalent towards them as everything is a data island; switching apps causes data loss and is not a pleasant experience for patients. Amazingly there are 40,000+ apps on the App store at Apple alone, showing huge demand from users, but probably a handful can talk to each other in a meaningful way; this is both on the consumer and professional side of healthcare.

Individual vendors such as Withings have made impressive strides towards data consolidation on the platform, but these are not baked into the OS, so will always have a lower adoption rate. If we take the music industry example further, Apple entering a market with a full push of an ecosystem at their scale, legitimizes the technology in ways that other vendors simply can’t match. In their introduction, Apple introduced 2 healthcare specific items, the Health App and HealthKit Framework.

The Health app is a central data repository on your phone that any HealthKit enabled app can deposit data into or read data from, under user control; it also serves as a display dashboard for the user of this data repository if they don’t want to use the source app. This will allow patients to aggregate their fitness and health data from a myriad of sensors (e.g. FitBit) and sources (say a PHR app) into a single place.

They showed using this as a gateway to broker between health goals, such as blood pressure control, set up by a physician on the Mayo Clinic’s EHR and then tying that back to the patient via the PHR app/Health App linkage. Since the patient can push data back once they grant permission to an app, you can imagine as a physician who is titrating blood pressure medications in the home, getting objective data from the patient electronically (the last mile problem). Engaging our patients is both our sworn duty as physicians and over time as we learn to use these tools effectively, will help us help our patients to be more self sufficient; as our mentor Warner Slack always says “the least utilized resource in the healthcare system is the patient!”

HealthKit is to me in some ways more significant, as it allows a common platform internally for health apps allowing for common data formats, data exchange, storage and presentation to the patient; Apple again is establishing an ecosystem here. Having centralized support for healthcare data, makes applications more interoperable and useful. Several of the healthcare vendors, such as Epic (I was seated near their CTO who was pumped), who were near me were very excited about integrating this framework into their apps. This will raise all the healthcare apps to a new level, and greatly increase utility and innovation around these apps.

There is some very legitimate concern for providers, that this will enable an avalanche of data (on top of the tsunami we already are being washed by) from patients, and we will have to figure out how to cope with this. With easier access to sensor data, patients will have to be educated, that not all changes are pathologic. A million years of evolution has allowed your body to control things like heart rate robustly, so we will need to be very specific in our education to patients about what they should and should not get concerned about. For patients undergoing fitness programs, this is a superb way to track fitness and can report objective improvement metrics to their healthcare provider or trainer.

Now for some non-healthcare specific technologies, that are very useful in healthcare.

TouchId, the technology behind the fingerprint login on the iPhone, is now open to 3rd party applications. This means that instead of relentlessly typing a password (which of course gets longer/more complicated with each policy change) you could for instance sign orders or login to your EHR; I type my password well over 100 times per day into the EHRs that I use, which gets frustrating, and can probably be quantified in lost productivity over all the docs multiplied by all the time spent reentering passwords as a serious sum of money.

A tiny change is that you can now respond to text messages and accept/decline appointments without leaving your current application. Why is this significant? While for many users this is a convenience, in healthcare this may prevent medical errors. John has previously cited a case of distracted computing occurring in the middle of creating orders for a patient, and leaving the task without signing orders, etc. Staying in context makes this error much harder to do.

Finally I will talk about Swift. Apple has created a new object oriented language, called Swift, which as they phrased it “took the C out of Objective-C”. This excited me as it reduces many common programming errors that are easy to create in C (for non-programmers, C is a language where you can do anything you gosh-darned please; and with great power comes great responsibility). They seemed to have stuck in some of the automagic of a language like Python with some of the strictness of Java, and then added modern power features, all in a very fast compiled language (under the awesome LLVM compiler).

In summary, I think we will look back on the WWDC 2014 as a day when Apple really brought the healthcare app industry to a whole new level, especially on the consumer side, and also putting in a robust infrastructure for professional and consumer applications to exchange data. This is a 1.0 release, and undoubtedly it will grow over time, and we will see creative uses, which will inspire all of us to grow with it. Similar to digital music, we are at the beginning of a major shift, and we will have to see what develops out of this, but getting consumers excited about healthcare data, and getting vendors excited about sharing data with each other via the patient, has got to be a good thing.

The Top 10 Things a geek patient Can Do to Enhance Security

If you have embarked on the fantastic journey of Health Information Technology and Electronic Health Records, you probably would own a good IT infrastructure by now, or at least you would plan to make one.  By definition of IT security, consider every potential hackers out there to eye for your network. With this intent plan your strategy, best practices and rubrics. Hackers constantly innovate and remember SECURITY IS A JOURNEY, SECURITY IS AN ONGOING PROCESS, Security is not a product.

Protecting the privacy of your own Health Record (Personal Health Record like www.myfamilyhealthportrait.com or www.healthvault.com) is a doable task if you start strong, strategic and be knowledge driven.

This blog tries to simulate Dr. John D Halamka's blog by placing the blogger as a geek patient who responds to Dr. Halamka's calls

 

To Start This Journey we will divide each blog into
1. Knowledge Takeaway
2. Suggestion takeaway
3. Policy Takeaway
4. Best Practice Take Away
5. Questions left unanswered and Request for Crowdsourced Approaches

##0001

 

 

Top 10 things a geek patient can do to enhance security. [THE STARTER KIT TO APPROPRIATE SECURITY IN ANY HEALTHCARE ORGANIZATION]

 

 

1. Policies/Governance - Without policies and governance, enforcing security best practices is impossible. Do you allow IM or not? In this WhatsApp era should you be soliciting advices from your doctor friends? Should you transfer pics? Do you allow modems to be attached to computers without IT approval? Can data be copied onto a thumb drive and transported off site? Such major policy questions must have definitive answers and sanctions for violating these policies must be enforced.

 

 

Dr. Agarwal's Patient Centered Medical Home OPC Pvt Ltd's current technology policy is found here

State Government's policy can be found here

Federal Government's Policy and Guidelines can be found here

 

 

 

2. Risk assessment and stratification - Do you consider the HIV status of patients to be the same security priority as protecting the data integrity of the library catalogue? Probably not. I have copied established 4 classifications of risk, which are practiced at BIDMC, Boston.

 

 

 **** Internet connected clinical data which is patient identified. Compromise of a passwords could lead to access of thousands of patients records

 

*** Internet connected clinical data which is patient identified. Compromise of a passwords could lead to access to one patient record

 

** Internet connected clinical data which is not patient identified. Compromise of passwords could lead to access of aggregate data without patient identifiers

 

* No patient records available

 

 

 Our journey to enhance security focuses on **** and *** data first. By ensuring our latest technologies and techniques protect our most sensitive data, we apply our people and budgets to the areas of greatest risk.

 

 

 3. Firewalls -

 

 

 BIDMC's Policy - "many years ago, we used the "Blanche Dubois" approach to security - a firewall that empowered academic collaboration but relied on the "kindness of strangers". One of our first security enhancements in the 1990's was to replace our permissive firewall (allow anything except where prohibited) with a restrictive firewall (deny everything except were permitted). During this process we eliminated 99% of our publicly available IP addresses, eliminated peer to peer traffic, and created a demilitarized zone (DMZ) for our web servers." John Halamka, CIO, BIDMC

 

 

 

 4. Intrusion detection and prevention/Host intrusion protection - recognizing that operating systems are patched continuously and that applications have vulnerabilities, there are attacks that take advantage of the time between a patch being released and a patch being applied.

 

 

 BIDMC Best Practice: We've employed software that provides "zero day" protection - eliminating the kinds of traffic between servers that are suggestive of attacks or questionable behaviour. We do this network wide and on individual servers, especially our web servers.

 

 

 

 

 

5. Remote access methods - the security of the network is only as good as its weakest point. Remote access technologies such as SSLVPN, Metaframe, and Remote Desktop via thin client computing devices minimize the threat of viruses from remote access points. Ideally, all computers accessing protected healthcare information should have up to date operating system patches, up to date antivirus software and no software which could compromise the security of the device (i.e. peer to peer file sharing)

 

 

 

 

 

6. Network Access Controls - in most institutions, hackers wanting to access a hospital network can walk in the front door, unplug and existing computer and access the network with whatever nefarious devices they choose. Less malevolent is the traveling vendor who plugs a laptop into the network to do a demo, giving viruses and spyware on that laptop full access to the hospital networks. Technologies such as Cisco's Network Admission Control and

 

Microsoft's Network Access Protection restrict network access to known machines containing the right versions of the right software needed to ensure end to end security.

 

 

7. Vulnerability Assessment - Many healthcare applications have vulnerabilities which can lead to inappropriate disclosure of patient data. Typical vulnerabilities include buffer overflows, SQL/Javascript injection attacks, and cross server scripting attacks. Hiring "white hat" hackers to perform penetration testing of mission critical applications, networks, and operating systems helps identify potential problems before security is compromised. Even if vendors do not repair these deficiencies, Host intrustion protection software can mitigate risks by surrounding systems with an extra layer of vigilance, stopping attacks before they start.

 

 

8. Provisioning/Authentication/Authorization - Having robust processes to grant passwords only to qualified users, terminate accounts when staff leave the organization and enable only the "minimum need to know" access to clinical data are foundational to good security. When passwords are issued, they should be strong (non-English words, mixed case, numbers and letters, greater than 8 characters long etc.), expire at a reasonable internal (at least yearly), and be role-based. Registration clerks should not be able to access medication lists or psychiatric notes, only those demographic data elements needed to perform their duties.

 

 

9. Anti-virus/Anti-Spyware - The design of Windows operating systems, in which all internal "services" run as the administrator, creates a vulnerable environment that necessitates the need for anti-virus and anti-spyware software.

 

 

10. Audit trails - Authorized Internal users can be even more of threat than external hackers. Collecting audit trails and implementing a program to monitor accesses is essential. Has one account accessed more than 20 patients a day? Has more patient been examined by more than 20 accounts? Who is accessing employee healthcare records? Who is accessing the record of a famous athlete or actress? Audit trails and tools to mine audit data help answer these questions.

 

 

These ten areas are a starter kit to appropriate security in a healthcare organization. Security cannot be an afterthought, it is project that must be resourced. A well trained and staffed security team is essential to success. To keep our organizations secure, I have a full time Security Officer and a team of security professionals maintaining our firewall rules, intrustion detection/prevention software, and our auditing systems. Compliance with HIPAA is a key motivator to implement good security, but most important is retaining the trust of our patients. We are the stewards of their data and our security systems are the last defense against breaches of confidentiality.

 

 

 

 

 

 

 

 

 

“Cues taken from Dr. Halamka's blog dated Oct 21, 2007

 

Providing security is a journey and we have been on the path to security best practices for many years. The following is my top 10 recommendations to guide this journey