Finding a cure: the case for regulation and oversight of electronic health record systems.

• Author: Hoffman, Sharona

TABLE OF CONTENTS I. INTRODUCTION II. EHR SYSTEMS: BACKGROUND AND ANALYSIS A. What Are EHR Systems? B. Benefits of EHR Systems 1. Facilitating Access to Patients' Medical Records 2. Improving Quality of Care and Reducing Poor Treatment Decisions 3. Cost Savings 4. Promoting Research C. The Challenges of EHR System Implementation 1. Potential for Errors 2. Privacy and Security Concerns 3. Expense, Time, and Burden 4. Legal Issues III. THE ROLE OF THE LAW AND ADMINISTRATIVE REGULATION A. Why Are Legal Interventions Necessary? 1. Financial Support for Universal EHR System Adoption 2. The Need for Quality Control 3. The Current Oversight System: CCHIT B. Who Should Regulate? 1. FDA Jurisdiction 2. Oversight by the Center for Medicare & Medicaid Services or a Newly Created Agency IV. RECOMMENDATIONS FOR A REGULATORY FRAMEWORK FOR EHR SYSTEMS A. Addressing the Cost of EHR System Adoption 1. Financial Support 2. WorldVistA B. Regulating Approval and Oversight of EHR Systems 1. Initial Approval of New Products 2. The Role of Local System Oversight Committees 3. The Need for Continued Monitoring C. EHR System Standards and Criteria 1. Best Practices Standard 2. Interoperability 3. Audit Trails and Capture/Replay 4. Addressing Privacy and Security Concerns 5. Decision Support 6. Enforcement D. Improving Health Care Through EHR-based Research V. CONCLUSION I. INTRODUCTION

In the foreseeable future, it is likely that the familiar, paper-based patient medical files, contained in thick folders and stored on long shelves or in filing cabinets, will become a thing of the past. Both the federal government and health care advocates are enthusiastically promoting the adoption of health information technology ("HIT") and electronic health record ("EHR") systems (1) as means to transform and improve health care in the U.S. (2)

An editorial published in The New York Times in August 2007 noted that the World Health Organization, in 2000, ranked the U.S. health care system 37th out of 191 and identified our poor use of information technology as among the primary reasons for this "dismal" ranking. (3) The editorial decried the fact that "American primary care doctors lag years behind doctors in other advanced nations in adopting electronic medical records or prescribing medication electronically." (4) Indeed, only seventeen percent of physicians in ambulatory care settings (5) use EHR systems to any extent, and only eleven percent of hospitals have fully implemented EHR systems. (6)

Medical errors have been estimated to result in as many as 98,000 deaths each year in the U.S. and to cost as much as $29 billion. (7) Appropriate use of carefully designed EHR systems could dramatically reduce those numbers. These systems can promote efficiency, diminish costs, save time, and save lives. For example, the Palo Alto Medical Foundation learned of Merck & Co.'s recall of certain batches of hepatitis A vaccine that had lost their potency and was able, using its EHR system, to identify 17,000 patients who needed to be revaccinated. (8)

The personal experiences of an emergency room doctor at a large Texas hospital provide two more vivid illustrations of the need for HER systems. (9) In one case, a woman with a splint on her arm stated that she had a broken arm, was suffering severe discomfort, and had run out of the painkillers she was given when initially treated at another hospital. In the absence of access to the other hospital's records, the doctor ordered X-rays of her arm and neck, only to discover that she had no injury. The time and expense wasted in uncovering the woman's scheme to obtain prescription narcotics could have been avoided had the physician been able to discredit her claim through a search of electronic records. In a second instance, the doctor treated a paraplegic patient who had a urinary tract infection. Because he did not have access to the patient's records at other facilities, the physician did not know that the infection, caused by the patient's permanent urinary catheter, was resistant to the antibiotics that he had prescribed. The patient died of heart failure in the hospital.

Politicians and government leaders have expressed great enthusiasm for the development and implementation of EHR systems. In April 2004, President George W. Bush announced plans to ensure that most Americans' health records are computerized within ten years (10) and to create a National Health Information Network ("NHIN"). (11) Numerous proposed bills have been introduced in Congress to promote HIT initiatives. (12) Executive and legislative efforts at the state level have established strategies and target dates for HIT implementation, commissions to develop recommendations for HIT use, and financial incentives for HIT adoption. (13) EHR systems also became an issue in the 2008 presidential campaign, as both Senators McCain and Obama discussed their potential benefits. (14)

However, the novel and significant risks generated by EHR systems cannot be ignored. (15) Products with poor information display and navigation can impede rather than facilitate providers' work. (16) The growing capabilities of EHR systems require increasingly complex software, which heightens the danger of software failures that may harm patients. To illustrate, one report relates that a hospital pharmacy's computer program generated erroneous medication order lists, leading to the delivery of the wrong drugs to patients in many wards. (17)

Thus far, the legal literature has not assessed the need for careful regulatory oversight of EHR systems akin to that required, in principle, by the Food and Drug Administration ("FDA") for life-critical medical devices. (18) This Article begins to fill that gap. It analyzes EHR systems from both legal and technical perspectives and examines how law can serve as a tool to promote HIT. Extensive regulations already exist to govern the privacy and security of electronic health information. (19) Privacy and security, however, are only two of the concerns that merit regulatory attention. Perhaps even more important are the safety and efficacy of these life-critical systems.

The benefits of EHR systems will outweigh their risks only if these systems are developed and maintained with rigorous adherence to the best software engineering and medical informatics practices and if the various EHR systems can easily share information with each other. Regulatory intervention is needed to ensure that these goals are achieved. Once EHR systems are fully implemented, they become essential to proper patient care, and their failure is likely to endanger patient welfare. (20)

The remainder of the Article will proceed as follows: Part II provides background and analysis of EHR systems, including their benefits and risks. Part III assesses the need for regulatory oversight of EHR systems. Part IV develops detailed recommendations for the contents of a regulatory framework. These recommendations include a requirement that all health care providers use approved EHR systems and that the government provide financial assistance to support the implementation of the new systems. In addition, the proposal addresses the following: the selection of an agency to regulate EHR systems; the creation of approval and monitoring processes for EHR systems; the standardization of system features and capabilities; interoperability; and the establishment of a national research databank of de-identified (21) electronic patient records. Part V concludes.

2. EHR SYSTEMS: BACKGROUND AND ANALYSIS

   1. What Are EHR Systems?

      No universally accepted definitions have been developed for "EHRs" or "EHR systems." (22) There is, however, some agreement about their essential components. (23) EHR systems, as the term is used in this Article and by other commentators, do much more than keep records. (24) In 2003, the Institute of Medicine ("IOM") identified the following elements as "core EHR functionalities":

      * Health information and data: The system should display laboratory test results, allergies, lists of other medications the patient is taking, medical and nursing diagnoses, patient demographics, and providers' notes. (25)

      * Results management: EHRs should provide laboratory test results, radiology procedure results, and other treatment results electronically to enhance provider access to needed information and promote efficiency and easier detection of abnormalities. (26)

      * Order entry and management: Computerized medication orders and other care instructions can reduce or eliminate lost orders, duplicate orders, mistakes caused by illegible handwriting, and delays in filling orders. (27)

      * Decision support: Computer reminders and prompts can improve preventive care, diagnosis, treatment, and disease management. (28)

      * Electronic communication and connectivity: EHR systems should facilitate online communication among medical team members, other providers such as laboratories or pharmacies, and patients through e-mail, web messaging, integrated health records within and across treatment settings, telemedicine, (29) and home telemonitoring. (30) Communication should be possible among providers in different geographic locations and medical organizations. (31)

      With these features, EHR systems can significantly improve medical treatment by ensuring that patients' health information is easily available to providers who require it, by preventing or correcting clinicians' errors or oversights before they cause harm, and by helping to promulgate best medical practices. In addition, EHR systems can serve important administrative functions:

      * Patient support: Patient education and self-testing at home should be facilitated by electronic systems. (32)

      * Administrative processes: Electronic scheduling systems, insurance eligibility verification, billing, and claims processing systems should be components of EHRs. Computerized tools can also be used to identify individuals who are...