Hidden Cost of EMR -

Storing and Managing Electronic Records

The average EMR system is projected to cost between $40,000- $50,000 to get started. Additional costs will be added over the years, especially for digital storage. With the American Recovery and Reinvestment Act, qualified professionals (physicians, dentists, optometrists, podiatrists, and some chiropractors) can realize up to $44,000 in Medicare incentives (or $63,750 through Medicaid) through meaningful use of a certified electronic medical records software system. Multiple doctor practices can realize even more incentives.

Paper-based records require a significant amount of storage space compared to digital records. Not only do they take up a significant amount of space, but because the physical record must be saved for at least seven years they seem to pile up on each other exponentially.

In direct contrast, electronic media doesn’t require much physical space as compared to paper-based. Typically electronic media costs less to store. This means that the room currently being used to store all the paper charts could be converted into a treatment room or other usable space that generates revenue. That’s the good news.  The bad news is that electronic medical records have their own unique set of problems and now have to be stored for decades, some even longer than the patient is alive! High definition equipment is generating even more voluminous electronic records.

Just about all parties agree that a significant source of cost in health care delivery is associated with simply managing medical records -- by some estimates, as much as $1 billion to $2 billion annually. Electronic storage costs per record and per patient should be reduced over physical storage; however, complexities of managing electronic records and the increased retention periods can possibly make that number grow higher. Reducing costs associated with electronic medical record (EMR) retention and manipulation, therefore, is attractive to all parties.

There are several considerations that must be considered in managing and storing EMR data. The complexities associated with these considerations have the potential to drive the costs even higher than physical storage, depending on how they are implemented.

Security. It goes without saying that medical records are not like ordinary business data; these records must be absolutely secure. Regulations as well as a judicial record of successful lawsuits make the penalty for revealing personal medical data very painful and expensive. As a result, the potential liability of providing storage-related EMR services can be very high. While liability insurance is available for such breaches, liability prevention -- having the appropriate security protocols and data integrity checks to prevent data leakage in the first place -- is critical. Hardened storage with extensive access restrictions is a must, as is extensive background research on every employee having access to such records.

Chain of Custody. Not only does the data need to be secure, but logs of access will have to be maintained. The only way to prove that records were accessed properly is providing a full end-to-end chain of custody. EMR systems are being built to create an audit trail of access but what about access outside of those systems, like long term archival systems?  

Retention period. Medical records will have very significant retention requirements. In many cases, they outlive the patients whose health care history they represent by as much as seven years. Archival storage systems will need to recognize that such records have to remain viable for many years or decades. This includes ensuring that the storage media reliability testing continues to be consistent with existing technology. Thorough regular audits of storage media will be necessary to ensure the storage is viable and, if necessary, storage stewardship can be assumed by a third party or the archives can be migrated to newer technology. Depending on how viable in the long run you believe your operation to be, you may want to consider contractual arrangements with long-term archival providers and obtaining insurance that would pay for such long-term storage should your company fail.

Data integrity. EMR data can literally represent life-and-death information. Data integrity is paramount, especially if such data represents files such as high-resolution imaging. Introduction of errors can corrupt images and records needed for diagnosis and treatment, sometimes in ways that could threaten a patient's health. As with any data type, ensuring integrity can be very complex, especially since the data retentions for medical records are beyond the expected life expectancy of tape and even disk-based storage.

Scalability. Medical records can be voluminous, with each record set containing many megabytes of information. Patient databases can be very large, running to tens of terabytes for even a modest hospital. Such volumes demand a great deal of available storage and, since every visit to the doctor can generate large amounts of new data, the storage has to be very scalable.

Techniques for Reducing Costs

Out-Sourcing. Doctors and hospitals may want to consider hosted solutions to reduce some of their liability and cost of providing electronic medical records. An offsite data storage facility can leverage scale and scope to drive down the cost of storage significantly.  However, as noted above, you must ensure your vendor is in a position to guarantee data security, longevity, integrity and scalability, and these considerations aren't trivial. Storage facilities need to be hardened and include redundancy.  They must also regularly test the archives’ integrity and report on how well the archive is performing.  EMR services offerings must include strong security guarantees, and service providers must carry sufficient liability insurance to provide protection in cases of improper disclosure or inappropriate data destruction.

Compressing Medical Information. The amount of storage necessary to handle decades of hundreds of millions of peoples’ records will drive the medical community to seek cost effective solutions. Compression is one technique to be considered. There are a number of issues regarding compression, the most significant being the integrity of the data. There are “loss-less” compression techniques where the integrity of the data is not altered during the compression-decompression process. These loss-less compression techniques can reduce the amount of storage significantly.  However, what assurances exist that the decompression routines are still effective after decades of archival?  And what risks to long-term integrity are introduced when using compression techniques that can result in the loss of large amounts of information if even a few bits of storage are compromised.

Use of “Cheap” storage. Another method for reducing the cost of storage is to use a “more cost effective” storage medium. Currently, these cost effective solutions include tape and “low end” digital storage. Unfortunately these “low end” solutions typically have a lower than acceptable availability and integrity record.

Interfacing the EMR to off-line (Archived) Records.

EMR Systems are already built with the assumption that all the information for that patient may not necessarily be readily available. For years, the EMR workflow had manual processes to allow staff to locate and identify when all the appropriate information was available. Health Information Exchanges (HIE) have been started to help the electronic exchange of health information among authorized stakeholders in the healthcare community – such as care providers, patients, and public health agencies – to drive timely, efficient, high-quality, preventive, and patient-centered care. Interfacing to an Archival solution should be similar to the interfaces to HIE.

Interfaces need to be built in these general areas:

1.   Scheduling information from the archive

This can be a manual process within the EMR workflow or an API (Application Program Interface) can be built to automatically retrieve the information from the Archive.

2.   Alerts for when data is not immediately available (but “in transit”)

This can be a manual process within the EMR workflow or an API (Application Program Interface) can be built to automatically send an alert to EMR systems that the information is “in transit” from the Archive. The assumption is that the information from the Archive is not real time and can take minutes to days to be retrieved from the Archive.

3.   Archiving the information (moving it off the “real time” system)

Determining when a record should be removed from the “real time” system will fundamentally be the most important decision determining the cost of the storage. This decision must be a factor of the cost of storage, the time it takes to retrieve records from the archive and the amount of requests there would be on a daily basis. A program should be run periodically that determines that the information in the “real time” system has reached a certain “age” and no appointments are scheduled in the near future where that medical information will be needed. The record from the “real time” system should not be removed until confirmation has been made from the Archive system. Also simply removing the record from the “real time system” may not be enough since many systems have alternate indexes into the record and should be handled appropriately. Most likely “stubs” will need to be built in the “real time” system that archival data exists and the retrieval of data can be automated through the use of an API.

The initial population of the Archive.

The digital information on the existing EMR should be reviewed to determine what (if any) needs to be on the archive, what should stay on the EMR and which information should be in both places. However, there are several concerns on the initial population of the archive:

1.   Locating all the data that needs to be “ingested” into the archive can be a challenge. This data will most likely be in electronic (digital) as well as “paper-based.”

2.   More significantly will be the form and extent of the meta-data that needs to be built. This meta-data should describe the identity of the patient, type and date of the procedure,  physician information, access rights (who has authority to access information), chain-of custody (who has requested access) and any other information (decompression routines, decryption keys, programs, etc) necessary to access the records.

3.   The time necessary to populate the archive. Enough time and budget dollars need to be allocated to populate the information into the Archive. This can include programming to move electronic information as well as the effort to scan and digitize any paper based records.

4.   Destroying previous records. As records are moved into the archive, the replaced paper-based and digital records need to be destroyed. This may include DoD cleansing of electronic storage or physical destruction of paper based documents.

Ensuring the integrity of the information.

The extended storage timeframe requirements for EMR exceed all current storage medium. To ensure the integrity of the data, multiple replicas will need to be stored (in case one is damaged). The archived replica will also have to be tested to ensure the integrity of the information.

Summary

Although everyone agrees that the movement of the medical information to electronic media will have many long term benefits there will be a number of technical and cultural challenges to be addressed before cost effective, secure solutions are available.

Contact Visage Solutions today to see how we can assist you with this and other compliance matters.

_________________________________________________________________________

About Visage Solutions – www.VisageSolutions.com

Visage Solutions is a consulting company operating in the areas of regulatory compliance, risk assessment, information security, risk management and compliance processes. Utilizing our proprietary SingleVue™ and OpsAudit™ methodologies, the company focuses on assisting business entities in mitigating operational risk. Visage has provided solutions to a client base ranging from private, entrepreneurial companies to large multinationals. Our team is comprised of experienced executives, managers and consultants who can assist clients with the development, implementation and execution of their risk management and compliance strategy.