About a year ago, I had a conversation with a physician who told me that his physician group's several offices, along with the radiology and phlebotomy facilities, were going high-tech and paperless: snazzy convertible tablets/laptops for the docs, electronic health records (EHRs), computer-generated prescriptions, automatic posting of lab results to the EHRs, WiFi, etc....

I was very impressed and asked him if they had addressed the security exposures concomitant with WiFi, HIPAA compliance regarding the EHRs, backup and recovery, and so forth. He began to look distressed, and I thought maybe he should computer-generate a script for himself.

HIT is not new. Many provider organizations—such as hospitals, home healthcare agencies, and healthcare management organizations (HMOs)—have been engaged in HIT for 30 years or more. HIT received renewed attention and traction as an industry when Michael Leavitt, the Secretary of the U.S. Department of Health and Human Services (HHS), announced that HIT was an agency priority and when, in April 2004, the role of National Coordinator for Health Information Technology (HIT) was created and David Brailer, M.D., Ph.D. was appointed to the post. Although Brailer has since resigned the post, his goal to ensure that half of all Americans have a portable EHR by 2010 remains prima facie an agency objective.

It has been two and half years since Brailer released the following objectives for the agency:

1. Encourage providers (physicians) to implement EHRs.
2. Enable interoperability among providers to obtain EHRs.
3. Provide personal care.
4. Improve health.

Since that time, many healthcare providers, including many small and mid-sized provider offices, have scrambled to create EHRs. In their haste to implement EHRs (the number one item on Brailer's hit list)—along with the haste of the many vendors, consultants, and systems integrators (SIs) to accommodate them with the software, hardware, and services required to deploy EHRs—some things that may have been glossed over, especially among the small and low-end medium healthcare providers, are issues surrounding governance, open standards, interoperability, adequacy of the technology to address security and privacy, and compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Sarbanes-Oxley Act of 2002 (SOX). Yes, in their haste, many provider organizations have totally missed the point. After all, physicians are not IT or compliance experts, and many small physician offices do not even have an IT person, let alone an IT staff. Even the legal counsel they consult may not be up-to-date on law surrounding IT. So they invariably rely on consultants or office staff, who are also unlikely to be IT or compliance professionals.

Let me pause here for a moment as I am addressing the small and low-end of medium-sized provider organizations and the ISVs and consultants from whom they purchase technology and services. I am not talking about midsize-to-large healthcare organizations and upper-tier vendors, ISVs, and consultants.

Implementing EHRs has been daunting within the physician practice—sort of future shock to all those docs who were computer illiterate and had to adapt not only to technology per se but also to computer software that forced them to change the way they do medicine. EHR deployment has also brought a whole host of concomitant issues regarding compliance and patient medical record privacy and security. But this is only the beginning. What is about to become even more intimidating is the number two item: interoperability with the computer systems and the EHRs of other providers.

The fact is, a patient, even a healthy one, normally sees more than one healthcare provider. Add to that hospitalizations, imaging tests, and other screenings, and the number of providers can easily expand geometrically.

Today, some small to medium-sized healthcare providers have aligned themselves with providers in geographic areas such as in New York City and have become part of regional health information organizations (RHIOs). In this federated model, they are able to share patient information electronically in a mostly secure IT environment. The problem is going to arise when the EHR needs to be made portable and further amalgamated with information derived from disparate non-related or non-federated healthcare providers. Ah, here's the interoperability rub!

Many provider organizations have not planned for this. My message to small provider organizations is to do the due diligence early on. Or, if you have already purchased and deployed an EHR application, contact the vendor and determine whether the application is built on standards such as Health Level 7 (HL7), which is a formatting and protocol standard in healthcare, whether it can easily interoperate with other systems thru use of APIs, and whether it is compliant with federal regulations. Find out what the labs, hospitals, imaging, and other facilities with which you contract are using. Finally, ask your patients who their other physicians are and contact them about their own EHR initiatives.

My message to vendors is that this is an opportunity to provide end-to-end service by offering not only technology, but also expertise and advice to your clients. Those vendors that have applications built on open standards, that are using airtight security middleware, that are ensuring their applications are compliant, and that can provide this type of value-added assistance to their clients will likely succeed in the coming years.

Traditionally, the healthcare industry was a technology follower. Now, healthcare must look to other industries (such as finance) and consider including tighter security measures (such as public site key encryption). Healthcare must avoid the trap of technology for technology's sake because the currency with which it deals is patients' lives.

Maria A. DeGiglio is President of, and Principal Analyst for, Maria A. DeGiglio & Associates, an advisory firm that provides clients with accurate and actionable information on business and technology initiatives. You can reach Ms. DeGiglio at This email address is being protected from spambots. You need JavaScript enabled to view it..