Health Technology, Digital Healthcare
Article | September 7, 2023
The fall is a time of renewals and choices. It is also a time of so called “open enrolment” for health plans. It is the one time of year we can study and learn about the options offered through employers or government sponsored plans. Individuals and small business owners alike are also are faced with a myriad of choices with confusing and often contradictory language promising lower premiums with higher out of pocket costs for covered services subject to deductibles. What does it even mean anymore when your monthly premiums exceed your pay check and you still have to pay for your colonoscopy or your insulin? Where is it all going?
Let’s imagine you twist your ankle playing basketball. You might go to an urgent care, receive an X-ray, probably be examined by a non-physician, and then referred to your primary care, who can’t see you for a few weeks but eventually sends you to an orthopaedic who takes another X-ray and treats your injury. Weeks have passed, multiple visits, time out of work, and co-pays, not to mention the out-of-pocket fees associated with imaging and perhaps a $100 ace bandage. What stops you from going straight to the ankle specialist in the first place? First, we have become conditioned to follow the directions dictated by the insurance companies, even when restrictions are not in place, patients have been convinced that stepping out of line will make all insurance promises null and void resulting in catastrophic bills and financial ruin. Second, the doctors and their office staffs have been conditioned to deny entry to any patient who does not have the proper referral, authorization, or identification. There are dire consequences for both if the insurance rules are not followed and fear keeps both sides aligned.
The past two decades have seen an explosion of healthcare costs. Health insurance has become the single biggest line item second only to payroll for most businesses. It is no coincidence that as the government increased its role as payor with state subsidies, the prices have gone up. Much like college tuitions, when loans are easy to obtain and guaranteed by federal support, there is little to deter those in charge from increasing the price. After all, everyone is doing it, it must be OK, and even if students end up in debt, it will be repaid because they have received the value of a great education. Right? But unlike higher education, healthcare is a necessity. We cannot avoid it, and there needs to be a reliable mechanism in place to guarantee access.
Ironically, as charges and prices have continued to escalate, payments to doctors have diminished. Why medicine is the only service industry where there is no transparency is truly astounding, especially since the there has been no increase in so called “reimbursements” for decades. As physicians, we have been complicit, being fully aware of the discrepancies between what is charged and what a patient’s insurance will pay. Even as patients began to have higher deductibles, and therefore higher out of pocket expenses, we continued to follow the rules, asking insurance permission to collect payment from the patient. It is not surprising that bad debt accounts for over 50% of most account receivables and why over 70% of doctors are now employed by hospital networks or private equity, who not only go after patients, but benefit from the repricing that occurs when insurers pay a negotiated amount as opposed to the charge. In other words, we pay more not just for less, but for nothing.
But what if we twisted our ankle and went directly to that specialist and paid out of pocket a transparent price? What would it take for that to happen? Not much, the cost of care is predictable, and because payments have always been decreasing, most physicians have learned to be economical. Plus, out of pocket costs are capped by federal law, so no patient is really responsible for catastrophic bills. Charges inflate to cover overhead, but if payments were guaranteed and immediate, then the cost of doing business goes down. Add technologies like telemedicine to a practice and you have increased patient access to a doctor without adding more personnel. Direct pay doctors are emerging all over the country and have consistently offered better access and more affordable care. The bar is also being set by independent surgery centers and imaging centers who offer better outcomes at lower costs. Perhaps motivated by prohibitive pricing, better options have emerged that have moved patients away from expensive operating rooms to safe, office-based procedures. Even cutting-edge cancer therapies can be delivered at home, preserving more of the healthcare dollar for medical care rather than the complex system built to manage it.
Competition and choice inevitably drive prices, but in a monolithic system the price is not negotiated, but instead it is set by only a few, in this case the big insurers. Small businesses cannot compete when bigger companies come to town. Eventually, the local hardware store gives way to a national brand, and the consumer is left with fewer choices and eventually higher prices. Amazon disrupted this equation by creating a marketplace for individual buyers and sellers. The convenience of finding a trusted brand, no longer available locally, is irresistible and the reason why we became loyal consumers. Healthcare is no different. Trust exists implicitly between a physician and patient, because it is an authentic, empathetic, and logical relationship. Trust does not exist between a patient and their insurer, on the contrary it is an unsympathetic business relationship without transparency or consistency. Few doubt the insurance company’s top priority is the premium, not the patient. Creating a direct relationship between the doctor and patient is a common-sense approach that serves both stakeholders well, and requires merely a fair and affordable price. But do doctors have the capability or the will to do it and if so, can the rest of the system follow?
Never in the history of modern medicine have physicians been more dissatisfied. US healthcare used to lead the world in innovation and outcomes, now we struggle to break the top thirty. We may have the most brilliant doctors and scientists with access to the best resources, but the need to maximize profits while catering to special interests, be they commercial or political, has led us to favour certain therapies over others despite marginal proven benefits. Doctors have little autonomy and less authority; prescribed treatments are routinely denied by insurance companies without a second thought or appropriate peer review. In fact, insurers even renamed us “providers”, a term used to by Nazis when referring to Jewish doctors to devalue them professionally. Over 56% of physicians are burned out, nearly all report moral injury and as hospitals have systematically replaced doctors with non-physicians with limited training, we have watched the standard of care deteriorate. It is no wonder we have witnessed the single biggest loss in life expectancy since WWII. The prognosis is grim, but there are solutions.
We need to reinvent healthcare by removing the middleman. We don’t have to set the price, but we can make it transparent so patients can decide for themselves if it is worth the inconvenience, the delay, and the co-pay to use insurance or just pay directly. Health savings accounts are tax deferred and can cover an out-of-pocket maximum in just a couple of years. Paying for care means there are no surprise bills or out of network costs, because there are essentially no networks and therefore no need to follow restrictions. You’d be hard pressed to find a doctor or hospital unwilling to accept an immediate cash payment, especially when it costs nothing more than the service provided. There are no billing cycles, or claims to prepare, no up coding, or authorizations. Doctors free to care for patients, patients treated individually and not subject to protocols designed to maximize charges. There are literally thousands of direct pay primary care and specialists now available all over the country and they are building alliances with likeminded people providing imaging, ancillary services, surgery centers, and prescriptions all at fair market prices. More and more employers are moving toward medical cost sharing plans that not only lower the cost of care but the cost of administration. Even the biggest payor, namely the government, sees the benefit of price transparency and is piloting models of direct contracting.
We will always need coverage for those unexpected events, emergencies, or hospital-based services, but all the rest - doctor visits, screening tests, and outpatient procedures - are easily affordable. After all, do we use our car insurance to pay for an oil change? If we did, the cost would be prohibitive and few of us would drive. But health insurers have lost our trust, they no longer cover necessary services and no longer honour contracts with physicians or patients. It is time to offer another option and let the patients and doctors get back to the real business of medicine.
Read More
Health Technology, Digital Healthcare
Article | August 16, 2023
Global efforts to tackle gender inequality have grown in recent years. But there is still so much to be done. Figures from the United Nations show that outcomes for women and girls continue to lag across a range of issues, including poverty, education, work and health. And according to the World Economic Forum, at the current rate, it will take 108 years to close the gender gap.
Although healthcare is founded in objectivity and science, gender bias is still remarkably common. We wanted to understand more about female perceptions of healthcare, so we undertook consumer research that delved into the experiences of women compared to men. The results pointed to a clear disparity, finding that women are less likely to visit the doctor when they have symptoms of ill health and, in some cases, are taken less seriously when they do seek medical advice.
Women being left behind
According to our research, a significant proportion of British women feel disappointed in the healthcare they receive, with one in five reporting they weren’t taken seriously when presenting symptoms to a healthcare provider. What’s more, a staggering one in four said they are reluctant to seek medical advice at all for fear of wasting a GP’s time. These statistics suggest that, not only are female experiences of healthcare damaging their relationship with clinicians, but they could be eroding confidence in recognising and acting on warning signs and symptoms too.
This sentiment is particularly evident when focusing on cardiac care. One in eight women (13%) feel ignored when presenting symptoms of heart disease to healthcare professionals, compared to just 4% of men. And of UK adults who have received a coronary heart disease (CHD) diagnosis, women experiencing symptoms were 55% more likely than men to visit the doctor multiple times before receiving a referral for further investigation. On top of this, women are five times more likely to receive a false finding from the cardiac stress tests that are traditionally used to assess heart health.
“There does appear to be a gender bias in onward referral to secondary care and for diagnostics in the local area, which is influenced by the attending healthcare professionals’ risk assessment. Traditional teaching has led to gender bias, as we are programmed to attribute a lower level of pre-test probability and risk to females. This may have contributed to a general lack of awareness around cardiovascular health in women. For example, in a survey I carried out among more than 600 female employees working within North West Anglia NHS Foundation Trust, 82% said they didn’t feel informed about their cardiovascular health. Considering participants included some of the most medically informed women in the UK, the results speak volumes about how we view cardiac health among women.”
- Dr Rebecca Schofield, consultant cardiologist at North West Anglia NHS Foundation Trust
These widespread misconceptions around heart disease and heart attacks are often exacerbated by what we see in the media – think of the countless TV stereotypes of male characters clutching their chests and falling to the floor.
But given that CHD is responsible for one in 13 female deaths, it appears that public health efforts have failed to make people aware of the risks for women. It is, perhaps, not surprising then that 42% of women with CHD did not immediately recognise their symptoms as signs of heart disease. In short, women are missing out on time-critical diagnoses and treatment due to a lack of awareness and education among both healthcare providers and the public.
Technologies making a difference
Thankfully, progress is being made to improve healthcare outcomes for women. Innovative technologies are increasingly providing diagnostic solutions that can reduce incidences of human bias and give clinicians greater clarity on the presence or severity of different conditions in their female patients.
For example, AI is already being used to detect diseases such as cancer more accurately. Its adoption is facilitating reviews and translations of mammograms 30 times faster, with 99% accuracy, reducing the need for unnecessary biopsies.
There’s extraordinary potential for AI and healthcare, and it’s something the NHS continues to recognise, most recently with the launch of its Artificial Intelligence Laboratory (AI Lab) and NHS England’s (NHSE) MedTech Funding Mandate. The latter aims to accelerate the uptake of selected innovative medical devices, diagnostics, and digital products to patients.
As part of the NHS efforts, NHSE has mandated the HeartFlow Analysis for use in hospitals across England for patients, male or female, who might otherwise be sent for a cardiac stress test. The HeartFlow Analysis is a gender-neutral technology that takes data from a coronary CT scan of the heart and leverages deep learning (a form of AI) and highly trained analysts to create a personalised, digital 3D model of each patient’s coronary arteries. This then helps clinicians to quickly diagnose CHD and decide the appropriate treatment for patients of any gender. Time spent in hospital is minimised for patients and often layered testing and unnecessary invasive diagnostic procedures can be avoided.
Final thoughts
While AI is helping us tackle gender bias in certain areas such as oncologic and cardiac testing, healthcare professionals are not absolved of responsibility when it comes to confronting this problem. It remains incumbent upon clinicians to recognise unconscious bias that would deter them from referring women or minority patients for much-needed testing.
Outside of the hospital, public health education efforts must expand so that far more of us can recognise shortness of breath, nausea, vomiting, back or jaw pain, and other symptoms beyond chest pain to be indicators of a heart attack in a woman. Knowing what to look for and overcoming personal bias that might lead to these signs being disregarded, may allow us to help one of the more than 100 women who will experience a heart attack in the UK today.
Read More
Health Technology, Digital Healthcare
Article | August 21, 2023
Across the spectrum of healthcare delivery – payor, provider, vendor, consumer, there is a land rush underway to embrace consumer-centric care. With tools like value-based care, chronic disease management, retail services, analytics, and remote patient monitoring, healthcare organizations are pivoting towards capabilities that provide a deeper understanding of patient behaviors and address the whole patient and not just the condition.
Read More
Digital Healthcare
Article | November 29, 2023
The healthcare industry has become a prime target for cybercriminals in recent times.
According to The State of Ransomware in Healthcare 2023 report from Sophos, six in 10 healthcare organizations have been hit by ransomware in the last 12 months, up from 34% in 2021.
Among this uptick have been several headline-grabbing attacks. For example, Shields Health Care Group became the subject of the single-largest breach affecting any organization globally in April 2023, when 2.3 million patients of the Massachusetts-based medical services provider had their personal data stolen after a cybercriminal gained unauthorized access to the organization’s systems.
Meanwhile, in the UK, a ransomware attack on the University of Manchester occurred in June, affecting an NHS patient data set holding information on 1.1 million patients across 200 hospitals.
Critically, the wealth of data housed in healthcare networks, and the potential impact of data unavailability in healthcare, make the industry both attractive and lucrative to threat actors.
It’s no coincidence that the Sophos report shows the rate of encryption in the healthcare sector is at its highest level in recent years. Of those healthcare organizations which suffered a ransomware attack in 2023, 73% had their data encrypted – up from 61% in 2022. When cybercriminals can successfully take down hospital systems and/or encrypt patient data so it can’t be used, they can blackmail health service providers, demanding significant sums before reinstating systems and/or data availability.
Considering healthcare's critical role as the highest-stake industry in our society, where people's lives depend on its success, the likelihood of attackers achieving their goals is greater than in other sectors, as confirmed by the Sophos report. Indeed, of the 73% of healthcare organizations that had their data encrypted, 42% reported that they paid the requested ransom to recover data.
DSPT and the compliance burden
Without question, the security-related challenges in healthcare are mounting. Right now, industry organizations are operating against a backdrop of unprecedented operational and workforce pressures, spiralling demand for care and industrial action.
Moreover, there is a growing regulatory burden, with organizations continually asked to comply with evolving cybersecurity rules, battling with multiple compliance mandates at any given time.
Take the NHS as an example. According to the 2023 NHS Providers’ Regulation Survey, just over half (52%) of respondents said the regulatory burden on their trust had increased. And this is expected to ramp up further in the future, with the UK government setting out a new 2030 strategy aimed at bolstering cyber resilience in healthcare.
Among the compliance burdens that the NHS faces is the challenge of meeting the requirements of the newly updated Data Security and Protection Toolkit (DSPT).
Mandated to minimize cyber risks and enable healthcare providers to maintain a robust information security posture, the DSPT is not a simple checklist of security controls, but a comprehensive toolkit to evaluate current security maturity and establish a risk management programme.
Indeed, in more recent times, DSPT has moved away from being a guide for achieving certain levels of assurance, and toward a mandatory evidence-based system which demands NHS organizations align with 10 precise National Data Guardian (NDG) standards: 1. The organization assures good management and maintenance of identity and access control for its networks and information systems. 2. The organization closely manages privileged user access to networks and information systems supporting essential services. 3. The organization ensures passwords are suitable for the information being protected. 4. Process reviews are held at least once a year where data security is put at risk and following security incidents. 5. Action is taken to address problems as a result of feedback at meetings. 6. All user devices are subject to anti-virus protections, while email services benefit from spam filtering and protection deployed at the corporate gateway. 7. Action is taken on known vulnerabilities based on advice from NHS Digital, and lessons are learned from previous incidents and near misses. 8. The organization has a defined, planned and communicated response to data security incidents impacting sensitive information or key operational services. 9. The organization has demonstrable confidence in the effectiveness of the security of technology, people, and processes relevant to essential services. 10. The organization securely configures the network and information systems that support the delivery of essential services.
Reducing Compliance Challenges with the Right Solutions
Taken individually, these standards may not seem too strenuous to adhere to. However, to be compliant with DSPT, all 10 items need to be completed and deemed ‘satisfactory’.
To tick all 10 key boxes in the most effective and efficient manner simultaneously, organizations should consider their strategy carefully. This could involve embracing supportive tools to accelerate and enhance their compliance journey.
Boiled down, DSPT demands several key things, including unincumbered visibility of the entire ecosystem, as well as the ability to demonstrate secure access, logs and storage, and essential auditing processes to maintain data security.
Achieving these things might appear complicated, even daunting. However, there are solutions known as Security Information and Event Management (SIEM) systems on the market that can make achieving these capabilities, and in turn DSPT compliance, easy.
Here, we outline some of the key features to look out for to meet compliance: • Log retention: A modern SIEM should be able to provide a centralized log storage and big data platform that scales to any organization’s size. Platforms should be able to provide role-based access to log data, including ‘data privacy’ functionality that can mask sensitive data until approved. Log data should not be modified or removed by users once ingested into the platform, while all data held should also be indexed and fully searchable. • Identifying and disabling unnecessary accounts: A good SIEM will also provide account auditing facilities for Active Directory that allow administrators to quickly identify dormant accounts. They should also be able to remove privileged user access when no longer required or appropriate. More sophisticated platforms will be able to do this in an automated manner. • Easy identification of issues: Clear and easily readable dashboards, alerts and reports for user logging activity should be provided, including failed login, apparent brute-force attempts, and bad password management practices. Further, those using machine learning will be able to identify unusual behavior patterns based on a baseline of activities of users and their peer group. • Integrate with third-party threat feeds: It will also be able to integrate with a wide variety of third-party threat feeds that provide information about specific known threat payloads/hashes and destination domains/addresses.
Meeting the mandate
Of course, having the right features in place is only part of the puzzle. For organizations to be truly successful in embracing tools that enable them to meet DSPT compliance more effectively, they should work to ensure that solutions providers offer them ongoing support – both in terms of ease of deployment and to ensure that they are using key systems in an optimal manner.
Scalability is another important aspect to consider.
Systems should be able to scale and continue to support the organization as data volumes increase and become more complex over time.
In respect of scalability, organizations should take time to think about pricing models, ensuring that these are based on the number of devices (nodes). In doing so, it will become easier to accurately budget future costs, as well as provide greater budgeting certainty over the short, medium and longer term.
A converged SIEM allows organizations to prioritize the big picture over individual tools, enabling them to develop a seamless and easy to use security operations setup. Not only does this approach boost cost transparency and eliminate potential complexities with managing a variety of siloed products – equally, it reduces the burdens on security teams, eliminating complexities over system integration and enhancing performance.
A converged SIEM combines key technologies easily to offer improved security outcomes. In doing so, organizations can easily home in on specific standards and adopt security best practices while reducing the burden on security teams tasked with meeting DSPT compliance.
Read More