As health information technology and health information exchanges (HIEs) make progress on improving the quality of healthcare, one area that has received limited research is how HIEs can provide timely access to clinical information in response to a disaster. That’s the subject of the final report, released in July, of the Southeast Regional HIT-HIE Collaboration (SERCH), which makes recommendations to improve how the nation’s ability to respond to natural disasters through the use of HIEs.
The SERCH consortium, which was formed in November 2010, included representatives from states at high risk of hurricanes: Alabama, Arkansas, Florida, Georgia, Louisiana and Texas. Its aim was to come up with a strategic plan for sharing health information data among the Southeast and Gulf Coast states during a declared natural disaster, and includes an actionable plan for incorporating HIEs into disaster preparedness efforts. The members assessed the challenges of accessing medical records and coordinating health healthcare information among patient populations displaced during a disaster.
The report also addresses legal, technical and governance issues, and lays out steps states can take to align their HIE activities with emergency preparedness activities. It made five recommendations that any public or private organization planning to share electronic health information during a disaster should follow:
- Understand the state’s disaster response policies and align with the lead state agency (designated by the National Response Framework as responsible for Public Health and Medical Services Emergency Function #8) to coordinate public and private interests and create working relationships in planning for disasters.
- Develop standard procedures to share electronic health information across state lines before a disaster occurs.
- Consider enacting a memorandum of understanding to establish a waiver of liability for the release of records when an emergency is declared, and to default state privacy and security laws to existing Health Insurance Portability and Accountability Act (HIPAA) rules in a disaster. It also suggests using the Data Use and Reciprocal Support Agreement (DURSA) to address or expedite patient privacy, security or health data-sharing concerns.
- Assess the state’s availability of public and private health information sources and its ability to electronically share the data using HIEs and other data-sharing entities.
- Consider a phased approach to establishing interstate electronic health information-sharing capabilities.
As noted in the report, none of the consortium member states had an operational statewide HIE network as of September 2011. It envisions a three-phase approach for the technical aspects of providing data during a disaster. These include a foundation for data sharing, likely through transmissions of shared point-to-point encrypted messages of data from personal health records, cloud-based electronic health records, claims data and other information; privacy provisions; and, eventually, integrated access accompanied by participation agreements, privacy policies and business associate agreements.
HIE as a Model for Data Backup and Sharing
Separately, interviews with HIE leaders prior to the release of the SERCH report suggest that disaster preparedness should be taken seriously by HIEs, and suggest why HIEs are a useful platform for disaster planning across state lines. Within their own networks, HIEs are a model for sharing of patient data, while providing redundant systems for data storage for their provider organizations. Depending on the model of HIE, each takes a slightly different approach to protecting its data within its own network.
Dick Thompson, executive director and CEO of Quality Health Network (QHN), Grand Junction, Colo., which covers nearly all of the western part of the state, says the HIE, which is coming up on its seventh anniversary, has become “mission-critical to many of our stakeholders.” He notes that QHN is a Beacon Community organization that has deployed population health tools and virtual longitudinal patient records that provide medical histories of patients regardless of where they are in the state. It is also beginning to include business analytics and claims data to better correlate improvements in care quality and costs.
QHN is a federated model, with multiple disparate sources of data, in which participating hospital members retain copies of their own data, and have their own backup, failover and disaster recovery capabilities, he says.
He says QHN has been cognizant of the importance of disaster preparedness since the beginning, and put in place a disaster recovery plan within six months of its go-live. “It’s an important part of the business plan, and it’s important that we test it annually,” he says.
QHN contracts with an outside vendor (Optum, Eden Prairie, Minn.), which includes disaster recovery services. As the HIE has expanded its services, it has signed disaster recovery agreements with other vendors as well, he says. Thompson notes that disaster recovery testing is done in conjunction with the vendor, and takes into account configuration changes that have been made to the system. Data is synchronized daily between the primary data site and the secondary site. Testing should encompass people and process as well as technology, “so that people on both sides of the process understand that they can actually execute,” he says.
Christopher Henkenius is program director of Nebraska Health Information Initiative (NeHII), Omaha, Neb. He describes the HIE as the foundation for multiple functionalities— clinical information from multiple sources, as well as connections to the state, connections to the patients, and ordering and imaging capabilities—that many clinicians in the network rely on. “We’ve got doctors at NeHII who would rather use the HIE as opposed to their own EMR,” he says. “If we don’t have disaster recovery processes in place and business continuity processes in place we are significantly impacting those physicians who use NeHII.”
NeHII also contracts its technical services with Optum, and the agreement requires that the vendor has sufficient backup and recovery procedures, Henkenius says. He notes that the vendor has dual data centers with clustered servers and multiple communications vehicles.
Henkenius calls NeHII a hybrid federated model. The HIE takes a copy of each hospital’s stored data, which are backed up on a regular basis. If a server corrupts, the data fails over to the backup copy, he says. “It’s no different than backing up data at a company or an EMR at a hospital. It’s just backing up the data and making sure you have redundant systems that can access the backup,” he says. Each of NeHII’s hospitals has its own edger server for this purpose, and Optum handles the backup, off-site data storage, and recovery processes.
From a backup and recovery perspective, the HIE needs to be sure its edge servers contain the data from each of the member hospitals, particularly the master patient index, the provider directory, application systems that allow physicians to view the data, a VPN connection that allows the information to flow between the hospitals and the HIE, and applications that run in the background that facilitate the dissemination of the information, he says.
HealthInfoNet, Portland, Me., is a centralized HIE model. It began its demonstration phase in 2008 and has been live since 2010. “Everything is centralized for us, with all of our systems within a couple of data centers,” says Todd Rogow, director of IT and the regional extension center. All of the data is HL-7 based, with close to 400,000 messages per day flowing into its system. Access to the services is provided through an internal portal via a VPN connection.
In Rogow’s view, the centralized model has reduced some of the complexity as one system with many vendor modules. He says the HIE and its member hospitals have a basically one-to-one relationship, where the main concern is to keep the data flowing and making sure the portal service is up. Essentially the HIE’s role is that of an aggregator. If a connection does go down, the messages are not lost, they are simply queued up until the connection is re-established, he says.
Rogow says the NeHII database is large, approaching 1 terabyte in size. Clinicians who enter the portal are able to pull up patient information across multiple unique enterprise IDs for that patient, and clinical information across 15 categories. “They always get the most real-time view, and it’s all done within five seconds,” Rogow says.
At present imaging data is not stored, but that will change. In May HealthInfoNet announced it would pilot the nation’s first statewide image archive, sharable within the HIE. The archive will be cloud-based and stored in three redundant data centers across the country, and will be managed by Dell. It will be separate from the existing data storage infrastructure for non-imaging data, Rogow says. “That solution has disaster recovery as a major component, and is a benefit to our customers, because this becomes a redundant system for them,” he says. The pilot is expected to conclude this fall and expand statewide in 2013.
Rogow says that the HIE is typically the secondary system to the hospital’s primary EHRs, and has been used as a backup on at least one occasion. A large hospital in the state had an outage, making its EHR go down for a period of time, although the data feeds were still in place to the exchange, allowing the hospital to use the exchange to get data on the patients. “That was a real benefit, and we became part of their disaster recovery plan in that respect,” he says.
He notes that HealthInfoNet works with local vendor (Systems Engineering, Portland) that provides services around security and disaster recovery. It provides incremental backups of its databases and systems, going back six weeks in time. “That is something that is always running and backups are always being generated,” he says. If the need arises, data can be backed hourly, daily or weekly, he says. It keeps a digital copy of data going back a week in its own data center, and falls back to a tape backup for an additional five weeks. The tapes are kept at a secondary site about 100 miles from the primary site.
HIEs as a Basis for Regional Cooperation
All of those interviewed say that disaster preparedness was a factor in the choice of the HIEs architecture. One advantage of HIEs is that they offer a communication infrastructure as well as storage infrastructure that providers can fall back on; and, as Rogow notes, the data-sharing made possible by HIEs presents a unified story of patient data. As the ONC has recognized, those same capabilities make HIEs a powerful tool for sharing data across state lines in the event of a disaster.
Commenting on the SERCH report in a blog post, Lee Stevens, ONC’s Policy Office Director, described how he watched with great concern as Hurricane Isaac bore down on the Louisiana coast in late August, seven years after Hurricane Katrina devastated the area, and noted reports of people stranded on rooftops of Plaquemines Parish. “This was disheartening enough, but then I wondered if these evacuees would have access to their health records if they were displaced to a neighboring state.” Despite progress made since 2005, there is still plenty of work to do, he said. He added that the report’s recommendations on integrating disaster planning and HIE efforts offer a path forward for other states.
Click here for an article on how technology drives disaster preparedness at hospital systems.
