The increasing adoption of EHRs and other IT solutions designed to improve care and efficiency also introduce potential problems. Healthcare delivery organizations and oversight and regulatory groups are working to mitigate the hazards these electronic tools can pose to patients.

Health IT should be subject to randomized, unannounced, on-site inspections, says Dean Sittig, PhD, professor of biomedical informatics at the University of Texas Health Science Center, speaking during the Patient Safety Symposium at the Health Information and Management Systems Society’s annual conference in February.

It remains to be seen whether that kind of inspection will come to pass but not everyone thinks it necessary. “By definition, part of the Joint Commission’s responsibility is to ensure the safety of hospitals,” says Russell Branzell, CEO of the College of Healthcare Information Management Executives (CHIME). Healthcare organizations already are under the auspices of safety inspections that can address health IT. Despite that, “CHIME and other organizations are absolutely adamant about improving clinical quality and safety," he says. "Part of the whole initiative to automate is to improve clinical output and quality across the board.”

‘Natural byproduct’

Many organizations are starting to question whether the pace of Meaningful Use (MU) is negatively impacting patient safety. For example, Intermountain Healthcare CIO Marc Probst has said that the organization will likely not attest to Stage 2 this year over concerns about patient safety.

Intermountain is transitioning from a home-grown EHR to a commercial product and probably won’t have the new software running system-wide by the end of the year.

Growing concerns about patient safety are a natural byproduct of increasing EHR adoption, says Branzell. The frameworks, initiatives and studies on health IT’s impact on patient safety happening now are “appropriate attention relative to the adoption curve.”

Many CHIME members are concerned about the rate at which organizations are implementing technology without allowing time to improve clinical processes, Branzell says. “Organizations can only assume so much change so fast and do it in a safe and effective manner.” However, many hospitals are counting on receiving an MU payment to keep their books balanced. “They may not make a margin this year without that check so they’re almost forced to put this in too fast. That’s why we’ve been pushing for flexibility.”

Branzell is concerned that it will take a major failure for the government to react to pleas to slow down the pace of the MU program. CHIME and other advocacy groups don’t want hospital bankruptcy or a major patient safety problem to be the reason the Centers for Medicare & Medicaid Services finally respond to pleas.

Another safety concern is foundering between the paper and electronic worlds. “If enough people don’t make this a priority, then we will lose momentum and be stuck in a middle state of adoption,” says Branzell. That’s far worse than being in an unautomated system because “living in a hybrid world is quite dangerous. We might be creating bigger problems if we stop midstream.” While the automation and transformation brought about by MU “is the right thing, we think it needs to be done in a thoughtful, time-sensitive way so people can be successful.”

Priority No. 1

Another speaker during the Patient Safety Symposium at HIMSS14 was Matthew Weinger, MD, director of the Center for Research and Innovation in Systems Safety at Vanderbilt University Medical Center in Nashville.

Healthcare is on the receiving end of the broken promise of IT, he says. While health IT is “likely essential to achieving higher levels of healthcare quality and efficiency, few improvements in patient safety have been demonstrated outside of initial sites of development.”

There is a clear loss of efficiency and revenue upon initial implementation of a system but the real cost is hard to determine, he says. Beyond fees paid to vendors, there are training and support costs plus money spent on customization and ongoing enhancement to address poor usability and unmet user needs. That results in lost opportunities in the form of money not available to spend on other healthcare delivery improvements, he notes.

Patient safety must be priority No. 1, says Weinger. “Even a very low error incidence will yield millions of errors.” He cites the hundreds of patient deaths attributed to misprogramming of infusion pumps. The software causes are quite subtle, he says, but “the harms are real.” That mindset is not the norm in the average EHR company, he says. “[The safety mindset] wasn’t in the average medical device company 25 years ago. It has taken this long for IT to become safety oriented. We’re at beginning of this journey.”

Alan Kusinitz, managing partner of SoftwareCPR, a consulting firm specializing in crisis prevention and recovery, spoke with Weinger at HIMSS14. Even with a perfect EHR system, there is a lot to be done to configure, install and train users and take advantage of the many options users have demanded. “Some options are not really safe,” he says. “Users like flexibility, but the more flexibility you have the more inconsistency and complexity you have and more opportunity for problems in use.”

Kusinitz says software developers must make sure their products allow users to ensure safety and effectiveness. These products need to be evaluated in real-world environments—which doesn’t often happen, he notes. That evaluation can result in removing some features because they lead to harm. “That has happened to a lot of systems because the average user could not use it safely.”

Federal Efforts

The potential risks of health IT on patient safety has not escaped the Office of the National Coordinator for Health IT (ONC). The Health IT Patient Safety Plan was released in 2013 and identified two core objectives: To use health IT to make care safer and to continuously improve the safety of IT.

“Achieving these objectives is a shared responsibility,” the ONC report states. “No one entity or group can fully realize the potential of health IT to improve patient safety.”

ONC’s health IT safety strategy includes multiple initiatives in the three core areas of learning more about IT safety issues, improving safety and leading to promote a culture of safety.

Colin Banas, MD, CMIO of VCU Medical Center in Richmond, Va., sees the safety plan as “an effort to focus the message on why we’re all here—to achieve the triple aim. The linchpin of the triple aim is safety.” That message has gotten muddled, he says, due to the “regulatory reform we’re being asked to swallow within short periods of time. Meaningful Use Stage 2 and ICD-10 are taking up all of the oxygen in the room.”

Early this year, ONC released its Safety Assurance Factors for EHR Resilience (SAFER) guides. These nine toolkits, including checklists and recommended practices, aim to help providers make safer use of EHRs and other technology.

The SAFER guides are “a great start,” says Banas, calling them an attempt to “codify the key elements that we all should be seeking to achieve with our application of technology as well as giving us tools to see where we land in terms of assessment or risk assessment.”

ONC also sees reporting on health IT safety problems as integral to improvement. But, “reporting of health IT-associated hazards and events is easier said than done,” says Kathy Kenyon, JD, an ONC senior policy analyst. “A basic problem is helping clinical users and risk managers see the role of health IT in adverse events so they can report it.”

There is a low rate of voluntary reporting, she says, but one of the promises of health IT is that it can make reporting itself easier. “We need more and better research to know what to work on first.”

Healthcare safety organization, the ECRI Institute focuses on efforts such as improving the reporting of health IT safety problems so the entire community can learn. Healthcare organizations need a continuous feedback approach to health IT system safety and commitment from leadership to educating staff and advocating health IT safety as everyone’s responsibility, says Karen Zimmer, MD, medical director of patient safety, risk, and quality. Organizations also need to promote open communication, allocate adequate resources and establish a blame-free environment for robust reporting of any health IT-related problems.

Managing safety incidents

The ECRI Institute has identified the top five health IT-related events: system interface, wrong input, software issue/system configuration, wrong record retrieved and software issue/functionality.

Incidents do not occur in isolation, says Cindy Wallace, senior risk management analyst for the ECRI Institute. When there is an incident, an in-depth analysis must be conducted by a multidisciplinary team as well as those familiar with the particular hazard or incident, including health IT and other departments familiar with the technology, says Karen P. Zimmer, MD, MPH, medical director of ECRI's patient safety organization.

Following the investigation, staff should be provided with an analysis, says Wallace. “They need to know about error prevention strategies in place so they understand that reporting leads to improved patient care.” Attention to health IT safety is a continuous process in high reliability organizations.

The ECRI Institute annually names its top 10 health technology hazards. The list focuses on medical devices but one hazard for 2014 closely associated with health IT is data integrity failures in EHRs and other health IT systems. Data integrity is just one example of a health IT element that can run into issues regarding alphabetizing and order sets, says James Keller, ECRI’s vice president of health technology evaluation and safety. “We’re seeing data integrity problems when devices are connected to EHRs.”

ECRI launched an initiative during HIMSS14: Partnership for Promoting Health IT Patient Safety. This collaborative includes patient safety organizations, healthcare organizations and vendors to disseminate information on three main points: what kinds of events are happening, why are they happening and what can be done to prevent them, says Ronni Solomon, ECRI’s executive vice president and general counsel.

The goal is to “augment what we know about safety.” Vendor involvement will make innovation part of the process, she says, because they will be involved in analyzing safety events. That will help them learn about usability and enable them to improve their products.

Overall, Solomon sees the initiative leading to better information about how to implement technology, how to make decisions about it, how to structure leadership and how to avoid events. “We need to be able to communicate and understand why these events are happening and align patient safety in the hospital with the health IT functions in the hospital.”

One of the biggest issues is that many patient safety events don’t manifest as a health IT event, she adds. “They manifest as a medication error or a surgical mishap but when you look more deeply at what’s going on, you see that health IT plays a role.”

Hopefully, all these efforts within and outside healthcare delivery organizations will make a significant impact on patient safety and help prevent more adverse events.