Former FDA Commissioner, CMS Administrator McClellan adds Johnson and Johnson Board Membership to Positions with General Atlantic LLC, Capital Royalty, Castlight Health, and AvivReit

Our latest example of the interchangeability of top insiders within corporate health care and the government agencies that are supposed to regulate corporate health care comes via an announcement from Johnson and Johnson,

Johnson & Johnson (NYSE: JNJ) announced today that Mark B. McClellan, M.D., Ph.D., Senior Fellow in Economic Studies, and Director of the Initiative on Value and Innovation in Health Care, Brookings Institution, will join the Board of Directors on October 15, 2013.  Dr. McClellan will serve on the Regulatory, Compliance & Government Affairs Committee and the Science, Technology & Sustainability Committee of the Board.

As former commissioner of the U.S. Food and Drug Administration (FDA) from 2002 to 2004, and as the former administrator of the Centers for Medicare & Medicaid Services for the U.S. Department of Health and Human Services from 2004 to 2006, Dr. McClellan has more than two decades of public service and academic research experience. From 2001 to 2002, he served as a member of the President's Council of Economic Advisers and senior director for health care policy at the White House. During President William J. Clinton's administration, Dr. McClellan held the position of deputy assistant secretary of the Treasury for economic policy.

So Dr McClellan has gone from running the US Food and Drug Administration, the primary government regulator of the pharmaceutical industry, to stewardship of one of the biggest pharmaceutical (and biotechnology and device) companies.

Not noted in that announcement was that Dr McClellan has been collecting positions in health care corporations since at least 2009.  The examples I found included in chronological order:

2009 - General Atlantic LLC

This appears to be a private equity firm which claims to be a "leading global investment firm."

From a 2010 a Mergers & Acquisitions article,

A year ago, the firm hired Dr Mark McClellan, previously a commissioner of the Food & Drug Administration, to its healthcare practice as a special advisor.

According to the firm's current website, he is still a special advisor.  

2010 - Capital Royalty LP

In a 2010 press release, this apparently private equity firm claimed to be

a market pioneer and innovator in healthcare investing with a focus on intellectual property investments in FDA-approved biopharmaceutical assets

In that release, it announced the creation of a Strategic Advisory Committee that included Dr Mark McClellan.  He still sits on that committee. 

2012 - Castlight Health

In a 2012 press release, this firm claimed to be

developer of a personalized health care shopping portal offering unbiased information about health care cost and quality

That press release announced the addition of Dr McClellan to the firm's Advisory Board, on which he still sits. 

2013 - AvivReit

This firm "specializes in the ownership and triple-net leasing of post-acute and long-term care skilled nursing facilities (SNFs)" per its website.

Dr McClellan is currently on its board of directors.  He apparently was appointed in 2013. 

Notably, I did not see anything in any of these firms' announcements about Dr McClellan or their biographies of him that noted his board or advisory committee positions with other firms.

Summary

Dr Mark McClellan rose through the ranks in the US executive branch ending with positions as FDA commissioner and administrator of the Center for Medicare and Medicaid Services (CMS) within the Department of Health and Human Services (DHHS).  He served under two presidents, Clinton and George W Bush.  Within 3 years of exiting DHHS, he picked up his first important commercial position, at General Atlantic LLC, and then added other positions with Capital Royalty, Castlight Health, AvivReit, and now the biggest of all, Johnson and Johnson.  Meanwhile he apparently continues at the Brookings Institution.  He must be one very busy man.

This case could be lumped with those of another former FDA commissioner and Secretary of Health and Human Services who ended up as a Director of Medtronic (see this post),  another Secretary of DHHS who ended up on the boards of multiple health care corporations (see this post), a director of the National Institutes of Health (NIH) who became a Sanofi executive, etc, etc (see this post).

While some might argue whether his acquisition of a leading advisory position with a private equity firm three years after he left DHHS technically constituted a spin through the revolving door, Dr McClellan's cumulative acquisition of four more such positions within the following four years certainly demonstrates how our corporate dominated health care system and the government agencies which are supposed to be regulating it to assure the health and safety of patients, and the maintenance of the public health seem to be run by an interchangeable cast of insiders.  We have asked before whether we can trust federal regulators to put patients' and the public's health first when they know they could easily become  candidates for lucrative private positions in the companies they regulate, or which are affected by their regulations, presumably assuming they have not done too much during their time in government to offend the leaders of such companies.

We have noted that the system in which government and big corporations largely overlap in terms of their leadership and presumably goals is called corporatism.  One can argue that such systems end up being run primarily for the benefit of corporate and government insiders.

 Until we dispel the fog of corporatism that has spread over the government that was once supposed to be of the people, by the people, and for the people, expect no real health care reform, and expect continuing rising costs, declining access, and worsening patient care. Obviously, true health care reform would start with the government and its officials putting patients' and the public's health first, way ahead of the financial comfort of corporate leaders.

I would note that neither the currently controversial and now operational Affordable Care Act, nor any of its opponents schemes for alternatives addresses this issue.

by Roy M. Poses MD for Health Care Renewal 

An Open Letter to David Bates, MD, Chair, ONC FDASIA Health IT Policy Committee on Recommendations Against Premarket Testing and Validation of Health IT

From http://www.healthit.gov/policy-researchers-implementers/federal-advisory-committees-facas/fdasia:

The Food and Drug Administration Safety Innovation Act (FDASIA) Health IT Policy Committee Workgroup is charged with providing expert input on issues and concepts identified by the Food and Drug Administration (FDA), Office of the National Coordinator for Health IT (ONC), and the Federal Communications Commission (FCC) to inform the development of a report on an appropriate, risk-based regulatory framework pertaining to health information technology including mobile medical applications that promotes innovation, protects patient safety, and avoids regulatory duplication.

My Open Letter to the Committee's chair speaks for itself:

From: Scot Silverstein
Date: Mon, Sep 16, 2013 at 9:39 AM
Subject: ONC FDASIA Health IT Policy Committee's recommendations on Premarket Surveillance
To: David Bates

Sept. 16, 2013

David Bates, Chair, ONC FDASIA Health IT Policy Committee
via email
   
Dear David,

I am disappointed (and in fact appalled) at the ONC FDASIA Health IT Policy Committee's recommendations that health IT including typical commercial EHR/CPOE systems not be subjected to a premarket testing and validation process.  I believe this recommendation is, quite frankly, negligent. [1]

As you know, my own mother was injured and then died as a result of EHR deficiencies, and nearly injured or killed again in the recuperation period from her initial injuries by more health IT problems in a second EHR used in her care.  In my legal consulting and from my colleagues, as well as from the literature, I hear about other injuries/deaths and many "near misses" as well.  That your recommendations came in the face of the recent ECRI Deep Dive study is even more appalling, with the latter's finding of 171 health IT-related incidents in 9 weeks from 36 member PSO hospitals, resulting in 8 injuries and 3 possible deaths, all reported voluntarily. [2]

It is my expert opinion the issues that cause these outcomes would never have made it into production systems, had a reasonable, competent, unbiased premarket testing and validation process been in place.

Consequently, I have shared the FDASIA HIT Policy Committee's recommendations with the Plaintiff's Bar, and will use its recommendations in my presentations to various chapters of the American Association for Justice (the trial lawyer's association) - as well as to interested Defense attorneys so they may advise their clients accordingly.

I am also making recommendations that in any torts, individual or class, regarding EHR problems that would likely have been averted with competent premarket testing and validation, that the FDASIA HIT Policy Committee members who agreed with the recommendation be considered possible defendants.

I am sorry it has come to this.

Please note I am also posting this message for public viewing at the Healthcare Renewal weblog of the Foundation for Integrity and Responsibility in Medicine (FIRM).

Sincerely,

Scot Silverstein, MD
Consultant/Independent Expert Witness in Healthcare Informatics
Adjunct Faculty, Drexel University, College of Computing and Informatics

Notes:


[1] FDA Law Blog, Recommendations of FDASIA Health IT Workgroup Accepted, September 11, 2013, available at http://www.fdalawblog.net/fda_law_blog_hyman_phelps/2013/09/recommendations-of-fdasia-health-it-workgroup-accepted.html: "Of particular interest is the recommendation that health IT should generally not be subject to FDA premarket requirements, with a few exceptions:  medical device accessories, high-risk clinical decision support, and higher risk software use cases."

[2] "Peering Underneath the Iceberg's Water Level: AMNews on the New ECRI 'Deep Dive' Study of Health IT Events" , Feb. 28. 2013, available at http://hcrenewal.blogspot.com/2013/02/peering-underneath-icebergs-water-level.html.

-----------------------------------------------

Note: the following are listed on the linked site above as members of the committee:

Member List

• David Bates, Chair, Brigham and Women’s Hospital
• Patricia Brennan, University of Wisconsin-Madison
• Geoff Clapp, Better
• Todd Cooper, Breakthrough Solutions Foundry, Inc.
• Meghan Dierks, Harvard Medical Faculty, Division of Clinical Informatics
• Esther Dyson, EDventure Holdings
• Richard Eaton, Medical Imaging & Technology Alliance
• Anura Fernando, Underwriters Laboratories
• Lauren Fifield, Practice Fusion, Inc.
• Michael Flis, Roche Diagnostics
• Elisabeth George, Philips Healthcare
• Julian Goldman, Massachusetts General Hospital/ Partners Healthcare
• T. Drew Hickerson, Happtique, Inc.
• Jeffrey Jacques, Aetna
• Robert Jarrin, Qualcomm Incorporated
• Mo Kaushal, Aberdare Ventures/National Venture Capital Association
• Keith Larsen, Intermountain Health
• Mary Anne Leach, Children’s Hospital Colorado
• Meg Marshall, Cerner Corporation
• Mary Mastenbrook, Consumer
• Jackie McCarthy, CTIA - The Wireless Association
• Anna McCollister-Slipp, Galileo Analytics
• Jonathan Potter, Application Developers Alliance
• Jared Quoyeser, Intel Corporation
• Martin Sepulveda, IBM
• Joseph Smith, West Health
• Paul Tang, Palo Alto Medical Foundation
• Bradley Thompson, Epstein Becker Green, P.C
• Michael Swiernik, MobileHealthRx, Inc.

Federal Ex Officios

• Jodi Daniel, ONC
• Bakul Patel, FDA
• Matthew Quinn, FCC

 -- SS

A War on Patients: Panel Says EHRs Should Not Be Vetted Before Marketing and Deployment

"First, do harm - it's a learning experience, and injured or dead patients are just a bump in the road, anyway" - the apparent creed of the healthcare computing hyperenthusiasts

Joe Conn and Modern Healthcare published the following article:

Work group says OK to some HIT safety regs (link), Joe Conn, Modern Healthcare, Aug. 7, 2013

What is important is what safety regs the Workgroup said "no" to.  It comes as no surprise:

A federally chartered special work group with representatives from three federal agencies has submitted its draft recommendations on establishing a regulatory framework for health information technology. Chief among those recommendations is that health IT should not be subjected to pre-market federal regulation, but there were a few exceptions.

The exceptions are narrow, and are likely already covered as Class III medical devices by FDA (see http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/Overview/ClassifyYourDevice/):

The exceptions under which there should be FDA regulation, according to the work group, include medical device accessories to be defined as such by the FDA; certain forms of “high risk” clinical decision support systems, such as “computer aided diagnostics,” also to be defined by the FDA; and some “higher risk software” use cases to be defined by the committee's own safety work group.

They did acknowledge the need for postmarket surveillance:

... The group also recommended: developing a federally supported, post-market surveillance system for health IT products “to ensure safety-related decision support is in place,” creating a process for gathering information on safety issues, aggregated at the federal level and establishing a public process for “customer rating of HIT to enhance transparency.”

Dr. David Bates [a professor at Harvard Medical School], chairman of the Food and Drug Administration Safety Innovation Act work group, presented the preliminary findings Wednesday at a meeting of HHS' Health Information Technology Policy Committee.

Let me translate this to plain English:  the health IT systems that go in (and their upgrades and patches) are recommended to be free from pre-marketing regulation and regulatory vetting.  Patients are to be the guinea pigs for testing of the software.  

If patients are harmed or killed, they get the honor of being named as "postmarket surveillance learning cases" who gave their all for the betterment of healthcare information technology.  

(Without their consent, but who needs consent to test experimental and unvetted devices on guinea pigs?)

Bates did express some liability concerns:

Asked during a question and answer period following his presentation whether the committee had considered the liability implications of its recommendations, Bates said, “It's not something we discussed at length, but it's something we can discuss over the next month.”

I, on the other hand, as a legal consultant on health IT-related medical errors and evidence tampering, am considering liability issues.

Unfortunately, patients would rather be whole than in lawsuits (or dead).  Also, sadly, it's physicians and nurses who will bear the brunt, if not all, of the liability for bad outcomes due to defective IT such as at these two recent posts, with vendor alerts regarding serious flaws of medication and other orders not being retained:

• Another Health IT "Glitch" - Can Digital Disappearing Ink Kill Patients? - Siemens Safety Advisory Notification #1

• Can Digital Disappearing Ink (An EHR "Glitch") Kill Patients? Part 2 - Siemens Safety Advisory Notification #2

• and the others posted at this blog at query link: http://hcrenewal.blogspot.com/search/label/glitch

A clarification for all those proletarians who lack Harvard educations, and for the Workgroup members as well. Allow me to point out that the above manufacturer safety alerts of life-threatening fundamental flaws (involving entered text that "disappears", apparently found in live-patient scenarios, and the other "glitches" that did cause life-threatening errors sometimes en masse involving thousands of patients such as another apparent Siemens debacle at http://hcrenewal.blogspot.com/2011/11/lifespan-rhode-island-yet-another.html) would likely not have occurred if the systems had been vetted before being turned loose on patients.

Finally:  David and panel members, my mother and I thank you profusely. 

Oh wait...my mother can't thank you, she's dead from the toxic effects of un-premarket-vetted health IT on simple care processes at the very hospital where I performed my residency two decades ago.

She might have died a few times before she actually did thanks to other IT "glitches" that cropped up during her recovery from the first one, but I was able to (in one case, by sheer happenstance of showing up at  the right time) discover or provide staff with information to work around additional unvetted-health-IT flaws before those did her in.

It's taken more than a decade for critical-thinking, unconflicted writers and researchers ("iconoclasts") to force cybernetics-over-all hyperenthusasts (see here) like Bates and his panel members to own up the risks of health IT at all, e.g. via sites like this blog and this teaching site. These panel members IMO have their heads buried in sand.

Dr. Bates and his panel are, in my opinion, healthcare IT extremists, which is in part the apparent holding of the belief that computers have more rights than patients - and the other beliefs mentioned in this post:  "Another Health IT 'Glitch' - Can Digital Disappearing Ink Kill Patients?" at http://hcrenewal.blogspot.com/2013/08/another-health-it-glitch-can.html.

-- SS

Health Care Revolving Door Roundup

Increasingly, the regulatory and law enforcement functions of the US government in the health care sphere seem to be blending with the management of large health care organizations.  One mechanism for this is the "revolving door," the constant interchange of personnel between government agencies and corporate management. 


Here is a list of some of this year's interesting cases of people transiting the revolving door between US government agencies that are supposed to regulate health care organizations or enforce the relevant laws and the organizations subject to these regulations and laws.   Note that this list may not be complete.  It is difficult to keep track of these transitions. 

Leader of Health Care Fraud Section of Philadelphia US Attorney's Office to Teva Pharmaceuticals

Via MainJustice.org in March, 2013,

John Pease, who led the government and health care fraud section in the U.S. Attorney's Office in Philadelphia, has left the Justice Department for a job with a pharmaceutical company.

Pease, 45, is a new senior counsel at Teva Pharmaceuticals, where he oversees government investigations of the company for the Americas.  'I was just ready to try something different,' Pease said in an interview.

 Leader of US Department of Justice Fraud Section in Charge of Health Care Issues to Law Firm as Defender of Companies and Senior Executives

The initial notice again was via MainJustice.org in March, 2013

Sam Sheldon, the deputy chief in the Criminal Division's Fraud Section who oversaw health care fraud prosecutions, is leaving the Justice Department to join Quinn Emanuel Urquhart & Sullivan LLP.

Mr Sheldon's new job was made clear on the firm's website,

Sam Sheldon is head of the firm’s Health Care Practice Group.  He is a trial lawyer who represents companies and senior executives in litigation before the United States federal government including Department of Justice and Department of Health and Human Services, and other law enforcement and regulatory agencies.

FDA Deputy Commissioner for Global Regulatory Operations and Policy to Mylan

This story, in April, actually made it (briefly) to Reuters,

 Generic drugmaker Mylan Inc said on Tuesday it hired Deborah Autor, deputy commissioner for global regulatory operations and policy at the U.S. Food and Drug Administration, to help oversee its global regulatory strategy.

Leader of Health Care Fraud Enforcement of Philadelphia US Attorney's Office to Law Firm as Industry Defender

From Bloomberg, in August, 2013,

Marilyn May, a False Claims Act litigator at the U.S. Justice Department, joined Arnold & Porter LLP’s Washington office as litigation counsel with a focus on healthcare, pharmaceutical and medical device industry defense work. 

May was the head of healthcare fraud enforcement in the U.S. Attorney’s Office in the Eastern District of Pennsylvania. She coordinated healthcare fraud cases and investigations as well as handled False Claims Act cases involving pharmaceutical and medical device companies, hospitals, nursing homes and other healthcare providers, the firm said. 

The law firm's website states,

 Her litigation practice focuses on pharmaceutical, medical device and healthcare defense matters.

Summary

In each of these cases, a person with responsibility for regulation of and/or law enforcement for health care organizations went through the revolving door to either work for health care corporations subject to such regulation and/or law enforcement, or work for legal firms that specialize in defending such corporations and their leaders in regulatory and law enforcement actions.

As far as I know, none of these instances was the least bit illegal.  However, like previous examples of the revolving door, they raise the concern that people in government regulation or law enforcement who think that they may have future lucrative job prospects helping health care organizations attenuate regulation and law enforcement may not be the most enthusiastic, aggressive, or persistent regulators or law enforcers.  Why would one want to upset one's future employer?

While these cases of the revolving door are legal, they are clearly conflicts of interest in the sense that the prospect of such future employment likely may increase the risk of compromising a government official's devotion to serving the public and enforcing the law, if not in the legal sense.  In some particular case, the revolving door may actually lead to corruption according to the Transparency International definition, abuse of entrusted power for private gain, if not according to the legal definition.  Thus the continuing occurrence of government officials blithely transiting the revolving door no doubt was a reason that more than 40% of the public consider the US health care sector to be corrupt (see this post.)

True health care reform would require curtailing the severe sorts of conflicts of interest created by the revolving door.  This might require both improving pay and working conditions for government regulators and law enforcers, and specific laws to prevent immediate transitions from being a regulator/ law enforcer to handling corporate responses to or defenses of such regulation and enforcement.

Of course, I can already hear the protests of those people who decry paying more for government or increasing government regulation.  I can at least hope that the protests are not from those who personally profit from the current seemingly corrupt system.  

Is ONC's definition of "Significant EHR Risk" when body bags start to accumulate on the steps of the Capitol?

In a June 25, 2013 Bloomberg News article "Digital Health Records’ Risks Emerge as Deaths Blamed on Systems" by technology reporter Jordan Robertson (http://go.bloomberg.com/tech-blog/author/jrobertson40/), an EHR-harms case in which I am (unfortunately) intimately involved as substitute plaintiff is mentioned:

When Scot Silverstein’s 84-year-old mother, Betty, starting mixing up her words, he worried she was having a stroke. So he rushed her to Abington Memorial Hospital in Pennsylvania.

After she was admitted, Silverstein, who is a doctor, looked at his mother’s electronic health records, which are designed to make medical care safer by providing more information on patients than paper files do. He saw that Sotalol, which controls rapid heartbeats, was correctly listed as one of her medications.

Days later, when her heart condition flared up, he re-examined her records and was stunned to see that the drug was no longer listed, he said. His mom later suffered clotting, hemorrhaged and required emergency brain surgery. She died in 2011. Silverstein blames her death on problems with the hospital’s electronic medical records.

“I had the indignity of watching them put her in a body bag and put her in a hearse in my driveway,” said Silverstein, who has filed a wrongful-death lawsuit. “If paper records had been in place, unless someone had been using disappearing ink, this would not have happened.”

How can I say that?  Because I trained in this hospital and worked as resident Admitting Officer in that very ED pre-computer.  The many personnel in 2010 who were given the meds history by my mother and myself directed it not to paper for others to see, but to /dev/null.

Why can I say that?  Because the hospital's Motion for Prior Restraint (censorship) against me was denied outright by the presiding judge just days before the Bloomberg article was published (http://en.wikipedia.org/wiki/Prior_restraint):

Prior restraint (also referred to as prior censorship or pre-publication censorship) is censorship imposed, usually by a government, on expression before the expression actually takes place. An alternative to prior restraint is to allow the expression to take place and to take appropriate action afterward, if the expression is found to violate the law, regulations, or other rules.

Prior restraint prevents the censored material from being heard or distributed at all; other measures provide sanctions only after the offending material has been communicated, such as suits for slander or libel. In some countries (e.g., United States, Argentina) prior restraint by the government is forbidden, subject to certain exceptions, by a constitution.

Prior restraint is often considered a particularly oppressive form of censorship in Anglo-American jurisprudence because it prevents the restricted material from being heard or distributed at all. Other forms of restrictions on expression (such as actions for libel or criminal libel, slander, defamation, and contempt of court) implement criminal or civil sanctions only after the offending material has been published. While such sanctions might lead to a chilling effect, legal commentators argue that at least such actions do not directly impoverish the marketplace of ideas. Prior restraint, on the other hand, takes an idea or material completely out of the marketplace. Thus it is often considered to be the most extreme form of censorship.

The First Amendment lives.

(I wonder if it irks the hospital that they cannot perform sham peer review upon me now that the censorship motion is denied.  Sham peer review is a common reaction by hospital executives to "disruptive" physicians, but I have not worked there since 1987 and I no longer practice medicine.)

In the Bloomberg story Mr. Robertson wrote:

... “So far, the evidence we have doesn’t suggest that health information technology is a significant factor in safety events,” said Jodi Daniel (http://www.healthit.gov/newsroom/jodi-daniel-jd-mph), director of ONC’s office of policy and planning. “That said, we’re very interested in understanding where there may be a correlation and how to mitigate risks that do occur.”

In my opinion this statement represents gross negligence by a government official.  Ms. Daniel is unarguably working for a government agency pushing this technology.   She makes the claim that "so far the evidence we have doesn't suggest significant risk" while surely being aware (or having the fiduciary responsibility to be aware) of the impediments to having such evidence.

From my March 2012 post "Doctors and EHRs: Reframing the 'Modernists v. Luddites' Canard to The Accurate 'Ardent Technophiles vs. Pragmatists' Reality" at http://hcrenewal.blogspot.com/2012/03/doctors-and-ehrs-reframing-modernists-v.html  (yes, this was more than a year ago):

... The Institute of Medicine of the National Academies noted this in their late 2011 study on EHR safety:

... While some studies suggest improvements in patient safety can be made, others have found no effect. Instances of health IT–associated harm have been reported. However, little published evidence could be found quantifying the magnitude of the risk.

Several reasons health IT–related safety data are lacking include the absence of measures and a central repository (or linkages among decentralized repositories) to collect, analyze, and act on information related to safety of this technology. Another impediment to gathering safety data is contractual barriers (e.g., nondisclosure, confidentiality clauses) that can prevent users from sharing information about health IT–related adverse events. These barriers limit users’ abilities to share knowledge of risk-prone user interfaces, for instance through screenshots and descriptions of potentially unsafe processes. In addition, some vendors include language in their sales contracts and escape responsibility for errors or defects in their software (i.e., “hold harmless clauses”). The committee believes these types of contractual restrictions limit transparency, which significantly contributes to the gaps in knowledge of health IT–related patient safety risks. These barriers to generating evidence pose unacceptable risks to safety.[IOM (Institute of Medicine). 2012. Health IT and Patient Safety: Building Safer Systems for Better Care (PDF). Washington, DC: The National Academies Press, pg. S-2.]

Also in the IOM report:

… “For example, the number of patients who receive the correct medication in hospitals increases when these hospitals implement well-planned, robust computerized prescribing mechanisms and use barcoding systems. But even in these instances, the ability to generalize the results across the health care system may be limited. For other products— including electronic health records, which are being employed with more and more frequency— some studies find improvements in patient safety, while other studies find no effect.

More worrisome, some case reports suggest that poorly designed health IT can create new hazards in the already complex delivery of care. Although the magnitude of the risk associated with health IT is not known, some examples illustrate the concerns. Dosing errors, failure to detect life-threatening illnesses, and delaying treatment due to poor human–computer interactions or loss of data have led to serious injury and death.”

I also noted that the 'impediments to generating evidence' effectively rise to the level of legalized censorship, as observed by Koppel and Kreda regarding gag and hold-harmless clauses in their JAMA article "Health Care Information Technology Vendors' Hold Harmless Clause: Implications for Patients and Clinicians", JAMA 2009;301(12):1276-1278. doi: 10.1001/jama.2009.398.

FDA had similar findings about impediments to knowledge of health IT risks, see my Aug. 2010 post "Internal FDA memorandum of Feb. 23, 2010 to Jeffrey Shuren on HIT risks. Smoking gun?" at http://hcrenewal.blogspot.com/2010/08/smoking-gun-internal-fda-memorandum-of.html.

I also note this from amednews.com's coverage of the ECRI Deep Dive Study (http://hcrenewal.blogspot.com/2013/02/peering-underneath-icebergs-water-level.html):

... In spring 2012, a surgeon tried to electronically access a patient’s radiology study in the operating room but the computer would show only a blue screen. The patient’s time under anesthesia was extended while OR staff struggled to get the display to function properly. That is just one example of 171 health information technology-related problems reported [voluntarily] during a nine-week period [from 36 hospitals] to the ECRI Institute PSO, a patient safety organization in Plymouth Meeting, Pa., that works with health systems and hospital associations in Kentucky, Michigan, Ohio, Tennessee and elsewhere to analyze and prevent adverse events. Eight of the incidents reported involved patient harm, and three may have contributed to patient deaths, said the institute’s 48-page report, first made privately available to the PSO’s members and partners in December 2012. The report, shared with American Medical News in February, highlights how the health IT systems meant to make care safer and more efficient can sometimes expose patients to harm.

One wonders if Ms. Daniels' definition of "significant" is when body bags start to accumulate on the steps of the Capitol.

I also note she is not a clinician but a JD/MPH.

I am increasingly of the opinion that non-clinicians need to be removed from positions of health IT leadership at regional and national levels.

In large part many just don't seem to have the experience, insights and perhaps ethics necessary to understand the implications of their decisions.

At the very least, such people who never made it to medical school or nursing school need to be kept on a very short leash by those who did.

-- SS

Six Years Later, Ranbaxy - Oops, Daiichi Sankyo - Pleads Guilty to Adulteration, Pays $500 Million

It only took until 2013, but the US Food and Drug Administration finally secured guilty pleas and fines.  The basics are in an Associated Press story (via the Washington Post):

 A subsidiary of India’s largest pharmaceutical company has agreed to pay a record $500 million in fines and penalties for selling adulterated drugs and lying to federal regulators in a case that is part of an ongoing crackdown on the quality of generic drugs flowing into the U.S.

Federal prosecutors say the guilty plea by Ranbaxy USA Inc. represents the largest financial penalty against a generic drug company for violations of the Federal Food, Drug and Cosmetic Act, which prohibits the sale of impure drugs.

Note that the company pleaded guilty to criminal charges.

 The subsidiary of Ranbaxy Laboratories Limited pleaded guilty to federal criminal charges and the company separately agreed to resolve civil claims with all 50 states and the District of Columbia. The company had earlier set aside $500 million to cover potential criminal and civil liability stemming from the Justice Department investigation.

It admitted as part of the deal that it sold adulterated batches of drugs — including an antibiotic and generic versions of medications used to treat severe acne, epilepsy and nerve pain — that were developed at two manufacturing sites in India. 

Ironies

Note that this resolution has certain ironies.

Lateness

There is a saying that justice delayed is justice denied.  Note that it took six years to obtain the guilty pleas.  As noted by the AP,

 The problems were largely revealed by a whistleblower in a federal lawsuit filed in Maryland in 2007. 

Ambiguities about Responsibility

First, note that while all the headlines are about Ranbaxy, Ranbaxy is not really an independent company.  As reported by Reuters (and only by Reuters so far as I can tell at this time),

Ranbaxy ... [is] majority-owned by Japan's Daiichi Sankyo.

Second, as per the AP, see the comment made by the Ranbaxy CEO,

'While we are disappointed by the conduct of the past that led to this investigation, we strongly believe that settling this matter now is in the best interest of all of Ranbaxy’s stakeholders; the conclusion of the DOJ investigation does not materially impact our current financial situation or performance,' Ranbaxy CEO and managing director Arun Sawhney said in a statement.

Maybe there was something lost in translation, but the CEO certainly spoke as if someone else was responsible for the "conduct of the past."  Incidentally, it does not appear that so far any journalist has even sought comment from the people really in charge, at Daiichi Sankyo.

Third, just like many other cases we have reported before, no individual, especially anyone who authorized, directed, or implemented the bad behavior, was held legally responsible.  The cost of the fines will no doubt be spread among the corporate structures involved.  Since a company pleaded guilty, no individual pays a fine, much less goes to jail.

It does appear that when the settlement was first announced in 2011, a cut in compensation for top executives of Daiichi Sankyo was announced, but the cuts were temporary, and apparently in response to the immediate financial consequences of the settlement, not any larger implications.  See Bloomberg's report:

 Chief Executive Officer Joji Nakayama and board members will receive 5 percent to 30 percent less compensation for six months in response to the cut in the earnings forecast, Daiichi Sankyo said today. The company has lost about half its market value since agreeing to buy a majority stake in Ranbaxy, India's largest drugmaker, in June 2008. 

 The Contrast with the Case of the Adulterated Heparin

Note that in this case, there have been no allegations that patients were harmed by the admitted adulteration,  Per the AP:

 It’s not known whether the problems with the drugs led to any health issues.... The government’s allegations against the company make no claims that the drugs, whose strength, purity or quality differed from the specifications, harmed anyone.

In 2008, we began blogging about how  US patients started to get sick and die after being infused with heparin, the common anti-coagulant drug. As we have discussed repeatedly  (look here, and see the summary at the end of the post), Baxter International was selling contaminated heparin under its label which was made in unregulated workshops in China, and then transmitted through a complex chain of Chinese and US companies.

The AP article stated,

 The case comes as federal regulators and prosecutors focus attention on the quality of ingredients of generics and other drugs manufactured overseas, said Allan Coukell, an expert on drug safety at The Pew Charitable Trusts. He said the 2008 deaths linked to tainted batches of the blood-thinner heparin that were imported from China served as a 'wake up call' about just how much of the nation’s drug supply comes from overseas.

So perhaps this wake up call helped propel the current case against Ranbaxy, that is, Daiichi Sankyo.  However, since 2008, if there has been a criminal investigation of the tainted heparin, which appears to have been much more consequential, sometimes fatally so, to patients, the results have not been made public.  A cynic might note that the contaminated heparin was sold by a US based manufacturer of branded pharmaceuticals, not a foreign based manufacturer of generic drugs.

Summary

The most fundamental obligation of a drug company is to produce pure, unadulterated drugs.  The first attempts to regulate the drug industry in the US were meant to ensure that these companies fulfilled this obligation.  Yet now there is increasing evidence that the contemporary pharmaceutical industry has trouble with this most basic responsibility. 

As we discussed here, the managers of pharmaceutical companies have been swept up in a dominant business management fad, outsourcing, as a means to cut costs to the bone.  (It seems that most health care managers are also caught up in the larger rage for financialization, to emphasize short term revenue over all other concerns, including patients' and the public's health.)  As the New York Times reported  re the Ranbaxy case,

Others say the company’s problems highlight how little oversight federal drug safety officials have of overseas plants. Studies that have shown the F.D.A. inspects foreign generic manufacturing plants about once every seven to 13 years, compared with once every two years for domestic manufacturers. A law passed last year will eventually require the F.D.A. to apply the same standards when inspecting all manufacturing plants, regardless of location. But some worry that federal budget cuts are slowing the adoption of that law. 

'They just happened to stumble across the Ranbaxy problem at those two plants in India,' said Joe Graedon, a pharmacologist who runs a consumer Web site, the People’s Pharmacy, which has raised questions about the safety of generic drugs. 'Ranbaxy was the biggest and one of the best in India. What about all the smaller ones? What does that say about them?'

Again, all pharmaceutical companies, not just generic drug manufacturers, have seen fit to outsource much, if not most of their production.

In our rush to market fundamentalism, we seem to have deregulated, at least de facto, most aspects of health care.  We now cannot trust the drugs we take to have been made by the companies whose labels they bear, or to be pure.  We now cannot trust that regulators will find that out, or having found that out, will do anything about it in a timely manner. 

To repeatedly reiterate, as long as the leaders of health care organizations are not held accountable for the results of their decisions on health care quality, cost, and access (even in such extreme quality violations as those resulting in multiple patient deaths), we can expect continuing decisions that sacrifice quality, increase costs, and worsen access, but that are in the self-interest of the people making them.

To really reform health care, we must hold health care organizations and their leaders accountable (and not blame all the problems on doctors, other health care professionals, patients, and society at large).

- Roy M. Poses MD for Health Care Renewal 


Appendix - Heparin Case Summary

- We have posted several times, recently here about the tragic case of suddenly allergenic heparin. Although heparin, an intravenous biologic anti-coagulant, has been in use for over 70 years, serious allergic reactions to it had heretofore been rare. Starting late in 2007, hundreds of such reactions, and 21 deaths were reported in the US after intravenous heparin infusions.All the heparin related to these events in the US was made by Baxter International.

- We then learned that although the heparin carried the Baxter label, it was not really made by Baxter. The company had outsourced production of the active ingredient to a long, and ultimately mysterious supply chain. Baxter got the active ingredient from a US company, Scientific Protein Laboratories LLC, which in turn obtained it from a factory in China operated by Changzhou SPL, which in turn was owned by Scientific Protein Laboratories and by Changzhou Techpool Pharmaceutical Co. Changzhou SPL, in turn, got it from several consolidators or wholesalers, who in turn got it from numerous small, unidentified "workshops," which seemed to produce the product in often primitive and unsanitary conditions. None of the stops in the Chinese supply chain had apparently been inspected by the US Food and Drug Administration nor its Chinese counterpart. (See posts here and here.)

- We found out that the Baxter International labelled heparin was contaminated with over-sulfated chondroitin sulfate, a substance not found in nature, but which mimics heparin according to the simple laboratory tests used in the Chinese facilities to check incoming heparin. (See post here.) Further testing revealed that the contamination seemed to have taken place in China prior to the provision of the heparin to Changzhou SPL. (See post here.) It is not clear whether Baxter International or Scientific Protein Laboratories had inspected most of the steps in the supply chain, or even knew what went on there.

- The Baxter and Scientific Protein Laboratories CEOs did not seem aware of where they got the heparin on which the Baxter International label was eventually affixed. But one report in the New York Times alleged that Scientific Protein Laboratories would not pay enough for heparin to satisfy any sources other than the small "workshops."

- Leaders of all organizations involved, Baxter International, Scientific Protein Laboratories, Changzhou SPL, the Chinese government, and the US Food and Drug Administration, and the US Congress assigned blame to each other, but none took individual or organizational responsibility. (See post here.)  Note that SPL was recently bought out and taken private, making its current leadership even less transparent (see post here).  A 2010 inspection of an SPL facility by the FDA revealed ongoing manufacturing problems (see post here).

- Researchers (who turned out to have financial ties to a company which is developing an anti-coagulant drug that could compete with the heparin made by Baxter International) investigated the biological mechanisms by which the contamination of the heparin lead to adverse effects, but no one investigated further how the contamination occurred, or who was responsible. (See post here.)

- Hundreds of lawsuits against Baxter have now been filed, so far without resolution. (See post here.)  Efforts to make documents to be used in these cases public so far have not succeeded (see post here).

- A government report which attracted little attention warned of the dangers of pharmaceutical ingredients made in China and subject to virtually no oversight. (See post here.)

-  Despite requests from the US, the Chinese government did not investigate the production of the heparin that lead to the deaths (see post here.)

-  In February, 2011, a congressional investigation of the case was announced, but results are so far unavailable (see post here.)

-  In June, 2011, a jury returned the first verdict in a civil case about the contaminated heparin, awarding money from Baxter International and Scientific Protein Laboratories to the estate of a man who apparently died due to tainted heparin (see post here).

-  If there was a criminal investigation of the case, its results have not yet appeared. 

HIMSS Senior Vice President on Medical Ethics: Ignore Health IT Downsides for the Greater Good

The Health Information Management Systems Society (HIMSS) is the large health IT vendor trade group in the U.S.  At a Sept. 21, 2012 HIMSS blog post, John Casillas, Senior Vice President of HIMSS Financial-Centered Systems and HIMSS Medical Banking Project dismisses concerns about health IT with the refrain:

... To argue that the existence of something good for healthcare in many other ways, such as having the right information at the point of care when it’s needed, is actually bad because outliers use it to misrepresent claims activity is deeply flawed.

Through the best use of health IT and management systems, we have the opportunity to improve the quality of care, reduce medical errors and increase patient safety. Don’t let the arguments of some cast a cloud over the critical importance and achievement of digitizing patient health records.

Surely, no one can argue paper records are the path forward. Name one other industry where this is the case. I can’t.

Let’s not let the errors of a few become the enemy of good.

The ethics of these statements from a non-clinician are particularly perverse.

The statement "Don’t let the arguments of some cast a cloud over the critical importance and achievement of digitizing patient health records" is particularly troubling.

When those "some" include organizations such as FDA (see FDA Internal 2010 memo on HIT risks, link) and IOM's Committee on Patient Safety and Health Information Technology (see 2012 report on health IT safety, link) both stating that harms are definite but magnitude unknown due to systematic impediments to collecting the data, and the ECRI Institute having had health IT in its "top ten healthcare technology risks" for several years running, link, the dismissal of "clouds" is unethical on its face.

These reports indicate that nobody knows if today's EHRs improve or worsen outcomes over good paper record systems or not.  The evidence is certainly conflicting (see here).

It also means that the current hyper-enthusiasm to roll out this software nationwide in its present state could very likely be at the expense of the unfortunate patients who find themselves as roadkill on the way to the unregulated health IT utopia.

That's not medicine, that's perverse human subjects experimentation without safeguards or consent.

As a HC Renewal reader noted:

Astounding hubris, although it does seem to be effective.  Such is PC hubris.  Who could ever call for reducing the budget of the NIH that is intended to improve health.  Has health improved?  No.

So why does a group with spotty successes if not outright failure never get cut?  It’s not the results, it’s the mission that deserves the funding.  So it’s not the reality of HIT, it’s the promise, the mission, that gets the support.  Never mind the outcome, it’s bound to improve with the continued support of the mission.

Is this HIMSS VP aware of these reports?  Does he even care?

Does he believe patients harmed or killed as a result of bad health IT (and I know of a number of cases personally through my advocacy work, including, horribly, infants and the elderly) are gladly sacrificing themselves for the greater good of IT progress?

It's difficult to draw any other conclusion from health IT excuses such as proffered, other than he and HIMSS simply don't care about unintended consequences of health IT.

Regarding "Surely, no one can argue paper records are the path forward" - well, yes, I can.  (Not the path 'forward', but the path for now, at least, until health IT is debugged and its adoption and effects better understood).  And I did so argue, at my recent posts "Good Health IT v. Bad Health IT: Paper is Better Than The Latter" and "A Good Reason to Refuse Use of Today's EHR's in Your Health Care, and Demand Paper".  I wrote:

I opine that the elephant in the living room of health IT discussions is that bad health IT is infrequently, if ever, made a major issue in healthcare policy discussions.

I also opine that bad health IT is far worse, in terms of diluting and decreasing the quality and privacy of healthcare, than a very good or even average paper-based record-keeping and ordering system.  

This is a simple concept, but I believe it needs to be stated explicitly. 

A "path forward" that does not take into account these issues is the path forward of the hyper-enthusiastic technophile who either deliberately ignores or is blinded to technology's downsides, ethical issues, and repeated local and mass failures.

If today's health IT is not ready for national rollout, e.g., causes harms of unknown magnitude (e.g., see this query link), results in massive breaches of security as the "Good Reason" post above, and mayhem such as at this link, then:

The best - and most ethical - option is to slow down HIT implementation and allow paper-based organizations and clinicians to continue to resort to paper until these issues are resolved.  Resolution needs to occur in lab or experimental clinical settings without putting patients at risk - and with their informed consent.

Anything else is akin to the medical experimentation abuses of the past that led to current research subjects protections such as the "Ethical Guidelines & Regulations" used by NIH.

-- SS

Old Mystery Solved? Former FDA Reviewer Speaks Out About Intimidation, Retaliation and Marginalizing of Safety

At my Dec. 2005 post "Report: Life Science Manufacturers Adapt to Industry Transition" I wrote:

... The recognition of a gap in formally-trained medical informatics-trained personnel in the pharmaceutical industry [by Gartner Group] is welcome. For example, from my own experience:

I recall an interview I had last year with the head of the Drug Surveillance & Adverse Events department at Merck Research Labs in a rehire situation [after a 2003 layoff]. I came highly recommended by an Executive Director in the department, to whom I had shown my prior work. This included well-accepted, novel human-computer interaction designs I'd developed for use by busy biomedical researchers for a large clinical study in the Middle East, as well as my work modeling invasive cardiology and leading the development and implementation of a comprehensive information system to detect new device and treatment modality risks in a regional center performing more than 6,000 procedures/year. In addition, I'd worked with the wife of the Executive Director in years prior, when she ran the E.R. of the hospital where I was director of occupational medicine.

Despite all this in my favor, the Executive Director's boss, himself a former FDA adverse events official [a former deputy director of CDER’s office of drug safety, who'd recently moved to the pharma industry he once regulated - ed.], dismissed me in five minutes as I was showing him the cardiology project, saying flatly "we don't need a medical informatics person here." I had driven 80 miles to Rahway for this interview to save the executive a trip to Pennsylvania, where I was originally scheduled to come for the interview, since the executive's father was ill in the hospital. In an instance of profound social ineptness, my effort was not even acknowledged. Perhaps he was in a bad frame of mind, but the dismissal under the circumstances was all the more disappointing.

I recall this was one of the most puzzling hiring debacles I'd ever experienced, as all the senior people in his dept. had recommended he hire me - I was really only there for his approval and signoff - and the work I'd shown him had improved care, saved lives, and saved money.

I may not need to be puzzled any longer.  This story just appeared:

Former FDA Reviewer Speaks Out About Intimidation, Retaliation and Marginalizing of Safety
By Martha Rosenberg, Truthout
July 29, 2012

The Food and Drug Administration (FDA) is often accused of serving industry at the expense of consumers. But even FDA defenders are shocked by reports this week of an institutionalized FDA spying program on its own scientists, lawmakers, reporters and academics that included an enemies list of "actors" and collaborators

... Ronald Kavanagh [FDA drug reviewer from 1998 to 2008]:  ... In the Center for Drugs [Center for Drug Evaluation and Research or CDER], as in the Center for Devices, the honest employee fears the dishonest employee. There is also irrefutable evidence that managers at CDER have placed the nation at risk by corrupting the evaluation of drugs and by interfering with our ability to ensure the safety and efficacy of drug ... While I was at FDA, drug reviewers were clearly told not to question drug companies and that our job was to approve drugs.

Read the entire story at the link.  I won't cover it more here, except to say it's certainly possible to believe certain FDA officials don't want serious people around -- who in addition to being MD's can write serious software to detect drug and device problems -- whose work can get in the way of drug approvals.

-- SS

Health IT FDA Recall: Philips Xcelera Connect - Incomplete Information Arriving From Other Systems

Another health IT FDA recall notice, this time on middleware, an interface engine that routes data:

Week of July 11

Product description:  

Philips Xcelera Connect, Software R2.1 L 1 SP2, an interface engine for data exchange [a specialized computer and accompanying software package - ed.]. Philips Xcelera Connect R2.x is a generic interface and data mapping engine between a Hospital Information System (HIS), Imaging Modalities, Xcelera PACS and Xcelera Cath Lab Manager (CLM). This interface engine simplifies the connection by serving as a central point for data exchange. The data consists only of demographic patient information, schedules, textual information and text reports.

Classification:  Class II

Reason For Recall	Xcelera Connect R2.1 L 1 SP2 , incomplete information arriving from unformatted reports interface

The data consists "only" of demographic patient information, schedules, textual information and text reports?

This is a dangerous fault mode, indeed.

"Incomplete information" moving between a hospital information system, imaging systems, a PACS system used to manage the images, and a cardiac cath lab can lead to very bad outcomes (and million dollar lawsuits), such as at "Babies' deaths spotlight safety risks linked to computerized systems", second example.

Note that the interface engine is in release 2.1, level 1, service pack 2.

In other words, a critical hardware/software product such as this undergoes constant tweaking (like Windows).

As a Class II device, at least the software is vetted to some degree by FDA:

Class II devices are those for which general controls alone are insufficient to assure safety and effectiveness, and existing methods are available to provide such assurances.^[8][10] In addition to complying with general controls, Class II devices are also subject to special controls.^[10] A few Class II devices are exempt from the premarket notification.^[10] Special controls may include special labeling requirements, mandatory performance standards and postmarket surveillance.^[10] Devices in Class II are held to a higher level of assurance than Class I devices, and are designed to perform as indicated without causing injury or harm to patient or user. Examples of Class II devices include powered wheelchairs, infusion pumps, and surgical drapes.^[8][10]

One wonders how testing of tweaks and updates to this product is done, if at all, other than on live and unsuspecting patients.

When you go into the hospital you are not just putting your life in the hands of the doctors and nurses, you're putting your life into the hands of computer geeks and software development experiments.

-- SS

July 25, 2012 Addendum:

The WSJ covered this here:  http://blogs.wsj.com/cio/2012/07/20/philips-recalls-flawed-patient-data-system/.  From their report:

... The problem that led to the recall: hitting the “enter” button, to start a new paragraph, in the summary field of heart test reports, sometimes caused the text entered below that point to be stripped from the report as it was transmitted into the patient’s electronic health record. And doctors later reviewing the patient’s electronic health record would not necessarily know they had received only part of the report, which could lead them to make “incorrect treatment decisions,” Philips said in a letter to hospitals.

...  Mike Davis, managing director at The Advisory Board Company, a healthcare research firm, says in the case of the Xcelera Connect, Philips should have caught the problem in testing. “How the hell does this get out? It shows there wasn’t good quality assurance processes in place.”

Indeed.

-- SS

FDA: Software Failures Responsible for 24% Of All Medical Device Recalls

At "FDA: Software Failures Responsible for 24% Of All Medical Device Recalls" via Kapersky Labs, a software security company, it is observed (emphases mine):

Software failures were behind 24 percent of all the medical device recalls in 2011, according to data from the U.S. Food and Drug Administration, which said it is gearing up its labs to spend more time analyzing the quality and security of software-based medical instruments and equipment.

The FDA's Office of Science and Engineering Laboratories (OSEL) released the data in its 2011 Annual Report on June 15, amid reports of a compromise of a Web site used to distribute software updates for hospital respirators. The absence of solid architecture and "principled engineering practices" in software development affects a wide range of medical devices, with potentially life-threatening consequences, the Agency said. In response, FDA told Threatpost that it is developing tools to disassemble and test medical device software and locate security problems and weak design.

... "Manufacturers are responsible for identifying risks and hazards associated with medical device software (or) firmware, including risks related to security, and are responsible for putting appropriate mitigations in place to address patient safety," the agency said in an e-mail statement.

Health IT medical devices are the exception, of course.  A health IT virtual medical device is always of rock-solid architecture, always uses "principled engineering practices" in software development, and never has life-threatening consequences, of course.

Hence its special regulatory accommodations over non-virtual (tangible) medical devices.

-- SS

WSJ "There's a Medical App for That—Or Not" - Misinformation on Health IT Safety Regulation?

There's a health IT meme that just won't die (patients may, but not the meme).

It's the meme that health IT "certification" is a certification of safety.

I expressed concern about the term "certification" being misunderstood even before the meme formally appeared, when the term was adopted by HHS with regard to evaluation of health IT for adherence to the "meaningful use" pre-flight features checklist.  See my mid-2009 post "CCHIT Has Company" where I observed:

HIT "certification." ... is a term I put in quotes since it really is "features qualification" at this point, not certification such as a physician receives after passing Specialty Boards.

The "features qualification" is an assurance that the EHR functions in way that could enable an eligible provider or eligible hospital to meet the Center for Medicare & Medicaid Services' (CMS) requirements of "Meaningful Use."  No rigorous safety testing in any meaningful sense is done, and no testing under real-world conditions is done at all.

I've seen the meme in various publications and venues.  I've even seen it in legal documents in medical malpractice cases where EHR's were involved, as an attempted defense.

Now the WSJ has fallen for the health IT Certification meme.

An article "There's a Medical App for That—Or Not" was published on May 29, 2012.  Its theme is special regulatory accommodation for health IT in the form of opposition to FDA regulation of devices such as "portable health records and programs that let doctors and patients keep track of data on iPads."

In the article, this assertion about health IT "certification" is made:

... The FDA's approach to health-information technology risks snuffing out activity at a critical frontier of health care. Poor, slow regulation would encourage programmers to move on, leaving health care to roil away for yet another generation, fragmented, disconnected and choking on paperwork.

The process already exists for safeguarding the public for computers in health care. It's not FDA premarket review but the health information technology certification program, established under President George W. Bush and still working fine under the Obama Health and Human Services Department. The government sets the standards and an independent nonprofit [ATCB, i.e., ONC Authorized Testing and Certification Bodies - ed.] ensures that apps meet those standards. It's a regulatory process as nimble as the breakout industry it's meant to monitor. That is where and how these apps should be regulated.

It's a wonderful meme.  Unfortunately, it's wrong.  Dead wrong.

Certification by an ATCB does not "safeguard the public."   Two ONC Authorized Testing and Certification Bodies (ATCB's) admitted this in email, as in my Feb. 2012 post "Hospitals and Doctors Use Health IT at Their Own Risk - Even if Certified".  I had asked them, point-blank:

"Is EHR certification by an ATCB a certification of EHR safety, effectiveness, and a legal indemnification, i.e., certifying freedom from liability for EHR use of clinical users or organizations? Or does it signify less than that?"

I received two replies from major ONC ATCB's indicating that "certification" is merely assurance that HIT meets a minimal set of "meaningful use" guidelines, not that it's been vetted for safety.  For instance:

From: Joani Hughes (Drummond Group)
Sent: Monday, March 05, 2012 1:06 PM
To: Scot Silverstein
Subject: RE: EHR certification question

Per our testing team:

It is less than that. It does not address indemnification although a certification could be used as a conditional part of some other form of indemnification function, such as a waiver or TOA, but that is ultimately out of the scope of the certification itself. Certification in this sense is an assurance that the EHR functions in way that could enable an eligible provider or eligible hospital to meet the CMS requirements of Meaningful Use Stage 1. Or to restate it more directly, CMS is expecting eligible providers or eligible hospitals to use their EHR in “meaningful way” quantified by various quantitative measure metrics and eligible providers or eligible hospitals can only be assured they can do this if they obtain a certified EHR technology.

Please let me know if you have any questions.

Thank you,
Joani.

Joani Hughes
Client Services Coordinator
Drummond Group Inc.

The other ATCB, ICSA Labs, stated that:

... Certification by an ATCB signifies that the product or system tested has the capabilities to meet specific criteria published by NIST and approved by the Office of the National Coordinator. In this case the criteria are designed to support providers and hospitals achieve "Meaningful Use." A subset of the criteria deal with the security and patient privacy capabilities of the system.

Here is a list of the specific criteria involved in our testing:
http://healthcare.nist.gov/use_testing/effective_requirements.html

In a nutshell, ONC-ATCB Certification deals with testing the capabilities of a system, some of them relate to patient safety, privacy and security functions (audit logging, encryption, emergency access, etc.).

What was suggested in the email below (freedom from liability for users of the system, etc.) would be out of scope for ONC-ATCB testing based on the given criteria. [I.e., certification criteria - ed.] I hope that helps to answer your question.

I had noted that:

... My question was certainly answered [by the ATCB responses]. ONC certification is not a safety validation, such as in a document from NASA on aerospace software safety certification, "Certification Processes for Safety-Critical and Mission-Critical Aerospace Software" (PDF) which specifies at pg. 6-7:

In order to meet most regulatory guidelines, developers must build a safety case as a means of documenting the safety justification of a system. The safety case is a record of all safety activities associated with a system throughout its life. Items contained in a safety case include the following:

• Description of the system/software
• Evidence of competence of personnel involved in development of safety-critical software and any
safety activity
• Specification of safety requirements
• Results of hazard and risk analysis
• Details of risk reduction techniques employed
• Results of design analysis showing that the system design meets all required safety targets
• Verification and validation strategy
• Results of all verification and validation activities
• Records of safety reviews
• Records of any incidents which occur throughout the life of the system
• Records of all changes to the system and justification of its continued safety

A CCHIT ATCB juror, a physician informatics specialist, has also done a guest post in Jan. 2012 on HC Renewal about the certification process, reproducing his testimony to HHS on the issue.  That post is "Interesting HIT Testimony to HHS Standards Committee, Jan. 11, 2011, by Dr. Monteith."  Dr. Monteith testified (emphases mine):

... I’m “pro-HIT.” For all intents and purposes, I haven’t handwritten a prescription since 1999.

That said and with all due respect to the capable people who have worked hard to try to improve health care through HIT, here’s my frank message:

ONC’s strategy has put the cart before the horse. HIT is not ready for widespread implementation. 

... ONC has promoted HIT as if there are clear evidence-based products and processes supporting widespread HIT implementation.

But what’s clear is that we are experimenting…with lives, privacy and careers.

... I have documented scores of error types with our certified EHR, and literally hundreds of EHR-generated errors, including consistently incorrect diagnoses, ambiguous eRxs, etc.

As a CCHIT Juror, I’ve seen an inadequate process. Don’t get me wrong, the problem is not CCHIT. The problem stems from MU.

EHRs are being certified even though they take 20 minutes to do a simple task that should take about 20 seconds to do in the field.  [Which can contribute to mistakes and "use error" - ed.] Certification is an “open book” test. How can so many do so poorly?

For example, our EHR is certified, even though it cannot generate eRxs from within the EHR, as required by MU.

To CCHIT’s credit, our EHR vendor did not pass certification. Sadly, our vendor went to another certification body, and now they’re certified.

MU does not address many important issues. Usability has received little more than lip-service. What about safety problems and reporting safety problems? What about computer generated alerts, almost all of which are known to be ignored or overridden (usually for good reason)?

 

The concept of “unintended consequences” comes to mind.

All that said, the problem really isn’t MU and its gross shortcomings, it is ONC trying to do the impossible:

ONC is trying to artificially force a cure for cancer, basically trying to promote one into being, when in fact we need to let one evolve through an evidence-based, disciplined process of scientific discovery and the marketplace.

Needless to say, as was learned at great cost in past decades, a "disciplined process" in medicine includes meaningful safety regulation by objective outside experts.

Further, the certifiers have no authority to do important things such as forcibly remove dangerous software from the market.  An example is the forced Class 1 recall of a defective system as I wrote about in my Dec. 2011 post "FDA Recalls Draeger Health IT Device Because This Product May Cause Serious Adverse Health Consequences, Including Death".   Class 1 recalls are the most serious type of recall and involve situations in which there is a reasonable probability that use of these products will cause serious adverse health consequences or death.

In that situation, the producer had been simply advising users (in critical care environments, no less) to "work around the defects" that could indicate incorrect recommended dosage values of critical meds, including a drug dosage up to ten times the indicated dosage, as well as corrupt critical cardiovascular monitoring data.  As I observed:

... I find a software company advising clinicians to make sure to "work around" blatant IT defects in "acute care environments" the height of arrogance and contempt for patient safety.

Without formal regulatory authority to take actions such as this FDA recall, "safeguarding the public" is a meaningless platitude.

It's also likely the ATCB's, which are private businesses, would not want the responsibility of "safeguarding the public."  That responsibility would open them up to litigation when patient injuries or death were caused, or were contributed to, by "certified" health IT.

I have in the past also noted that the use of the term "certification" might have been deliberate, to mislead potential buyers exactly into thinking that "certification" is akin to a UL certification of an electrical appliance for safety, or an FAA approval of a new aircraft's flight-worthiness.

The WSJ needs to clarify and/or retract its statement, as the statement is misinformation.

At my Feb. 2012 post "Health IT Ddulites and Disregard for the Rights of Others" I observed:

Ddulites [HIT hyper-enthusiasts - ed.] ... ignore the downsides (patient harms) of health IT.

This is despite being already aware of, or informed of patient harms, even by reputable sources such as FDA (Internal FDA memo on H-IT risks), The Joint Commission (Sentinel Events Alert on health IT), the NHS (Examples of potential harm presented by health software - Annex A starting at p. 38), and the ECRI Institute (Top ten healthcare technology risks), to name just a few.

In fact, the hyper-enthusiastic health IT technophiles will go out of their way to incorrectly dismiss risk management-valuable case reports as "anecdotes" not worthy of consideration (see "Anecdotes and medicine" essay at this link).

They will also make unsubstantiated, often hysterical-sounding claims that health IT systems are necessary to, or simply will "transform" (into what, exactly, is usually left a mystery) or even "revolutionize" medicine (whatever that means).

Health IT is a potentially dangerous technology.   It requires meaningful regulation to "safeguard the public."  How many incidents like this and this will it take before that is understood by the hyper-enthusiasts?

I've emailed the ATCB's that had responded to my aforementioned query for clarification on the WSJ assertion about their role, being that the statement is in contradiction to their earlier replies to me.  I also advised them of the potential liability issues.

However, if it turns out to be true that the ONC-ATCB's do intend themselves as the ultimate watchdog and assurer of public safety related to EHR's, that needs to be known by the public and their representatives.

-- SS