Preparing for a digital future in healthcare

White paper

Digital health information systems help doctors and health care providers deliver better quality care. With electronic health records, health care providers have a comprehensive, digital view of a patient’s health history, improving efficiency, collaboration and safety.

2/8Preparing for a digital future in healthcare

Introduction 3

Digital information requires new security tools 4

Bottom line 5

The role of ECM in meeting healthcare’s digital needs 5

Modules to prioritize in your ECM purchase 6

Solution 7

Web sources used for regulations and technical standards for compliance management 8

Contents

3/8Preparing for a digital future in healthcare

IntroductionThe stages of digital readiness varies widely among healthcare organizations. While some clinics and diagnostics companies started in the digital age and have never had paper files, older practices may have filing cabinets overflowing with paper records. In the middle, there are organizations that have moved new cases and much of their data to computerized systems but still rely on paper for most of their patient interactions.

For many healthcare organizations, the digital transformation is a slower, confusing process. They have digitized their data but their information is often still managed using traditional tools and methods. The difference between data and information is crucial and a nuance that many miss. Data is the structured facts and figures, the 1s and 0s that are contained in a database. The adoption of EMR technologies has largely tamed the data problem. Information, on the other hand, is more complex. Information in this instance is the unstructured data, which can include a PDF, email, image or a complex file type, such as an MRI or CT scan image and patient hand-off notes. By definition, unstructured information does not fit nicely in a structured database, such as an EMR, and requires an Enterprise Content Management solution.

While the EMR/EHR application will always be the central repository of patient data, there is a clear need to house old records and patient-related documents in a digital system. Using modern ECM, you will have a platform to both collect and manage information and act as a repository for that content. In the figure below, you can see a repository broken into categories that guide the user to the right piece of information. ECM also can be used to extract information from faxes, emails and scanned documents to ensure the care team has all the vital information no matter what source it comes from, while controlling administrative costs.

Figure 1: OpenText™ ApplicationXtender's search-based view allows for easy search of patient files based on document contents, as well as any extracted data from scanned documents.

This is the user view, it is simple and focused on information the user needs to do their job. It mirrors the terms and types of easily scanned information to make it easier to find items and to help new members of the care team understand the process. The solution is configured to show a unique view to each user based on their role in the workflow. It can be easily configured to recognize documents and apply the metadata, ICD-10, Medicare and other codes to enable billing, patient routing and compliance.

4/8Preparing for a digital future in healthcare

For care team members, finding patient information should be simple and not require their full attention.

Figure 2: In many clinics, finding prescriptions, test results and notes from other patient care team members is painful. This system eases that pain with a single search pane for paper, electronic and faxed information.

In today’s complex care management environment, organizations are looking for tools that can extend the usability of the EMR through simple workflow that presents information to the right person at the right time.

Digital information requires new security toolsAcross many industries, data breaches have become a hot button issue. The healthcare sector is dealing with this in many ways, including the HIPAA information security directives.

HIPAA’s information security directives are not limited to strictly clinical data. The directives are designed to protect patient accessibility to their own information that is held, used or managed by a healthcare organization. This may include the patient’s billing information or phone numbers and email addresses used to confirm appointments. This is personal information that could be the credentials needed to access the patient portal and view patient information.

It is also important to recognize that patient electronic documents don’t only need to be managed for regulatory purposes. For example, the Center for Medicare and Medicaid (CMS) is the main auditor for drug supply programs, however Health and Human Services oversees HIPAA information security audits. This complicates internal compliance management. For example, if you have a satellite clinic or partner who is a participant in any type of patient prescription program (for example, Medicaid programs, clinical trials), this is auditable by multiple regulators. These regulators may not be on your central compliance management group’s radar, leaving a small clinic to manage these materials, possibly without the resources to effectively control the information.

In Figure 2, the series of information capture points looks like the forms that doctors and nurses are used to scanning, making it easier for them to focus on the patient rather than a screen. Whether team members capture the information on a desktop or mobile device, they will have the same experience and data capture capabilities. The solution also auto-completes codes and provides tips on drug dosing and route of administration.

5/8Preparing for a digital future in healthcare

Organizations of all sizes need to move to digital. Many hospitals, especially single-site and primary care clinics, are still in the midst of transitioning from paper to digital files. These documents are burdensome and represent a key cost drain on the healthcare system and reduce profitability for small clinics and hospitals. Creating a searchable digital repository that can hold scanned documents and extract appropriate information will greatly reduce this issue. From a regulatory perspective, the expectation is that all of the information being moved will be handled appropriately to protect privacy while remaining accessible to patients upon request. The key to meeting this expectation is ensuring that your organization’s business rules are repeatable, auditable and treated as part of a record management process.

Bottom lineHIPAA requires standardized methods for managing, transmitting and accessing any clinically-related information. If you manage or simply have access to personally identifiable information, including insurance numbers, medical history or drug trials, you must be able to provide auditable processes to confirm that all access to patient information has conformed to a standardized operating procedures that ensures its integrity.

The role of ECM in meeting healthcare’s digital needs

Controlling administrative workflows and easy data sharing with the EMR of your choice

Many healthcare organizations will still have documents and processes that simply do not fit within the EMR system. In this case, using industry-standard software is simpler than attempting to modify or customize your EMR to meet your business needs.

Three areas where an ECM system and a modified EMR differ are:

1. Cost of licensing. On average, a single license for an EMR system is more expensive than a focused ECM product. The value of an EMR license is in the wide array of clinically relevant data that it can handle. If the user is only accessing patient insurance information, the value is not sufficient.

2. Maintaining permissions. Most healthcare organizations have a complex cross-departmental connection of admission, transcription and billing administration that is difficult to model in an EMR system but is relatively easy to model in a process-focused ECM solution.

3. Cost of customization. Most EMR systems are closed and require expensive professional services to make any changes. Furthermore, you may void upgrade paths and/or support agreements by performing the modifications without the using vendor services. Conversely, most ECM systems are designed to be modified by organizations and provide software development kits and user-friendly APIs.

6/8Preparing for a digital future in healthcare

Choosing ECM products to create an aligned system

In a perfect world, ECM solutions would be combined in a single enterprise-wide system with the flexibility to manage various use cases. In reality, financial information is managed by the ERP or CPOE application, medical information is handled by the EMR and imaging is handled by DICOM systems. So, instead, organizations should look for an ECM solution that will help unify this information through robust back-end services to extract data relevant to EMR and ERP applications. To successfully use a multi-product model, ensure the information capture mechanisms are aligned across physical and electronic entry points to the system.

Keys to successfully using ECM as the connective tissue between clinical and financial operations:

1. Process clarity. The goal should be to automatically move information from clinical uses into financial and administrative usage.

2. Start simple with process automation. Ensure that all pieces of information contain some metadata even if it is just the author name, filename and date accessed/created.

3. Take the time to develop metadata libraries. There are many options but yours should align with the existing clinical workflows and financial workflows.

4. Aligned permissions and data classification. Build a robust classification and permissions control system that allows departmental workers to get to any document they may need without signing in again or using different credentials. For example, time-off forms for all staff, as well as pharmacy drug requests can all be built in the ECM but only visible if you are part of the right groups. If you make users sign out and sign into a different system, they will stop using one of your systems–and it won’t be the one with the benefits and time-off requests.

Modules to prioritize in your ECM purchase

Integrated process/workflow management module that can:

• Provide reporting on instances of each process

• Tie information access to process steps

• Tie document creation to workflow steps

• Integrate into the document library for document access management

• Integrate into data management (as opposed to content/document management) systems to provide a single point of access for all information related to a workflow/process

• Automate the compilation of process information into a document ready for submission

• Integrate into external systems through HL7-FHIR (FDA’s eCDA and eTMF systems) or through SMTP with encryption (FIPS 140-2 compliant)

Records management framework

• Audit control for document access

• Audit for who was involved in processes

• Access control management

• Access and audit controls for changes made to processes, documents and system settings

7/8Preparing for a digital future in healthcare

SolutionThe right platform will have some of these features:

1. A strong records management core that can be managed by a single compliance or records manager

2. A BPMN-based workflow/process management module

3. A well-described set of tools to integrate the content into a user’s preferred work application, API and/or SDK, additional methods to use new XML/HTML-based screen scrape technology to connect systems

4. Granular access management that can be tied to existing tools, such as Microsoft® Active Directory®, with an internal system for when Active Directory settings and information management needs diverge

5. General system requirements and ease of use so that any department can find value

• Medical codes are not hardwired

• Metadata can be added, mixed, changed to ensure that any document can be appropriately accessed or deleted based on document relationships or user permissions

ECM provides a solution in managing information across different departments, particularly in these three areas:

1. Clinical to compliance. Managing the data, building the compliance package and submitting it is rarely performed by the same person. Multiple people in multiple departments require access to the same data to revise documents and approve the final copy.

2. Finance to clinical. Purchasing and getting paid for medical products requires appropriate approvals, documentation and codes that usually are not maintained by finance or compliance.

3. Human resources. Hiring and maintaining core clinical staff is difficult. It is often handled by managers on the clinical side but the documentation is managed and updated by HR.

An effective ECM solution captures unstructured information to improve collaboration, regulatory compliance and, most importantly, patient care. Finding the right solution will help your organization be equipped to thrive in healthcare’s digital future.

About OpenTextOpenText, The Information Company™, enables organizations to gain insight through market leading information management solutions, on-premises or in the cloud. For more information about OpenText (NASDAQ: OTEX, TSX: OTEX) visit: opentext.com.

Connect with us:• OpenText CEO Mark Barrenechea’s blog• Twitter | LinkedIn | Facebook

8/8Copyright ©2018 Open Text. OpenText is a trademark or registered trademark of Open Text. The list of trademarks is not exhaustive of other trademarks. Registered trademarks, product names, company names, brands and service names mentioned herein are property of Open Text. All rights reserved. For more information, visit: http://www.opentext.com/2/global/site-copyright.html • (01/2018)08762EN

opentext.com/contact

Web sources used for regulations and technical standards for compliance managementGuidance on EIM for all 21 CFR part 11 orgs (Directly references DoD 5015.2 as a key organizing document): http://www.fda.gov/ohrms/dockets/98fr/00d-1539-gdl0001.pdf

Consolidating regulatory frameworks in life science: http://www.mastercontrol.com/annex_11

Medical device Fed register of final rule: https://www.federalregister.gov/articles/2014/02/14/2014-03279/medical-device-reporting-electronic-submission-requirements#h-18

Current eFDR standards: http://www.ecfr.gov/cgi-bin/text-idx?SID=3ee286332416f26a91d9e6d786a604ab&mc=true&tpl=/ecfrbrowse/Title21/21tab_02.tpl\

Computer validation http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm085281.htm

Nice boil down for pharma: http://www.slideshare.net/jasminnuhic/complying-with-21-cfr-part-11-understanding-the-role-of-predicate-rules

FDA guidance on computerized control systems: https://www.fda.gov/iceci/enforcementactions/bioresearchmonitoring/ucm135196.htm

Importance of limited locations for documentation as the basis of FDA compliance: http://nifa.usda.gov/sites/default/files/resource/Overview%20of%20FDA%20Regulations%20and%20Process%20Validation%20Considerations.pdf

Overall guidance on complying with FDA requirements through document submission. http://www.fda.gov/downloads/drugs/guidancecomplianceregulatoryinformation/guidances/ucm400630.pdf

http://www.fda.gov/AboutFDA/ReportsManualsForms/Forms/default.htm

http://www.fda.gov/Drugs/DevelopmentApprovalProcess/FormsSubmissionRequirements/ElectronicSubmissions/ucm153574.htm

Follow the FDA’s approval process http://www.fda.gov/Drugs/DevelopmentApprovalProcess/FormsSubmissionRequirements/ElectronicSubmissions/ucm174459.htm

How to understand if you are a BAA: https://www2.idexpertscorp.com/blog/single/hipaa-business-associate-101-a-primer

Good matrix of the sub parts of HITECH/HIPAA compliance https://www.hlc.org/app/uploads/2014/05/HIPAA-101-Brief-Materials3-23-15.pdf

Relationship between FDA regulated devices and HIPAA rules: http://www.mddionline.com/blog/devicetalk/are-your-medical-devices-hipaa-compliant-08-25-15

Example of information database for life sciences: http://www.annalsthoracicsurgery.org/article/S0003-4975(08)00924-7/fulltext?refuid=S0003-4975(11)01666-3&refissn=0003-4975&mobileUi=0

Really good academic study: http://jamia.oxfordjournals.org/content/21/4/714.figures-only

Clinical research company http://forteresearch.com/news/hipaa-basics-for-clinical-research-qa/

Building BAA relationships: http://info.pharmaseek.com/acton/attachment/18595/f-0019/1/-/-/-/-/PS_Webinar_HIPAA%20%20Basics.pdf

Automating Audits using AD and ITSM tools https://www.manageengine.com/products/active-directory-audit/hipaa-compliance-reporting-tool.html

US Government administrative guidance for healthcare administration: https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/index.html

Enabling Meaningful use (and MACRA) technically: http://healthcaresecprivacy.blogspot.ca/2012/10/mu2-encryption-and-hashing.html?m=1

Dealing with paper and data residue form copiers and printers: http://www.milner.com/company/blog/technology/2015/06/24/how-to-make-copiers-and-printers-hipaa-compliant