Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue?

At "Networked, Interoperable, Secure National Medical Records a Castle in the Sky?" I wrote that the holy grail of electronic medical record efforts - the creation of a networked, interoperable, secure national medical records system - may be far more difficult than anyone expected due to vulnerabilities in current, widespread IT networking and OS platforms.

Now we hear the situation is even worse than in the articles I cited at that post:


Wall Street Journal
Feb. 18, 2010
Broad New Hacking Attack Detected

Global Offensive Snagged Corporate, Personal Data at nearly 2,500 Companies; Operation Is Still Running

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach.

The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

One can only imagine how internet-connected hospitals, generally an IT backwater, might fare under such an onslaught.

... In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier's military email account, NetWitness found. A Pentagon spokesman said the military didn't comment on specific threats or intrusions.

At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee's apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past.


Read the while article. These breaches are an unpleasant reality in 2010, but what's worse is there really are no solid metrics for the true extent of this 'disease.'

Perhaps future Internet technologies will reduce or eliminate the problem, as one reader suggested in a comment to my aforementioned post. I do not believe, however, that patients and their medical records should be used as guinea pigs until those new networking and security technologies are widely deployed and well-proven.

In effect, this is probably not a good time for actual records-level interoperability to be deployed in any manner other than in consideration of a future strategy. Operationalizing that strategy should probably await a time when the "digital ether" in which the data resides and moves is more mature, unless proprietary networks and technology are to be used and without connection to the Internet. Planning data-level compatibility between systems, on the other hand, is work that should continue.

Finally, the layoffs and staffing levels in today's IT departments (at both vendor and user shops), plus the outsourcing of critical IT functions to overseas contractors where workers' loyalty to the primary firm is questionable at best, may be a contributing factor to the nakedness of corporate America's information systems.

-- SS

University of California CEO - You Can Reduce My Pay if "You Throw In Air Force One"

The San Francisco Chronicle recently reported how students at the University of California have been providing a satirical approach to the problems of the university's leadership:
It's been a seriously dramatic year at the University of California, where hundreds of students seized buildings, demonstrated and shut down regents meetings last fall to protest rising tuition and the perceived privatization of the public school.

It's also been a satirically dramatic year, thanks to the UC Movement for Efficient Privatization, a fledgling group of mostly grad students in business attire that uses humor tinged with sarcasm to lampoon UC officials.

Their own name is an example. Many UC students believe leaps in tuition and reduced state funding are turning the public university into a private institution.

In particular, they drew attention to the university president's sense of entitlement:
UCMeP has made itself known on the Berkeley campus since September. That's when UC President Mark Yudof, who earns about $600,000, drew students' ire for telling the New York Times he'd take a $200,000 pay cut for salary parity with President Obama - if Air Force One were part of the package.

Seeing this as a philanthropic opportunity, UCMeP issued fundraising flyers: 'Help Buy Mark Yudof a Plane!'
The relevant parts of the New York Times interview, which I regret to say I missed at the time it was published, are:
Some people feel you could close the U.C. budget gap by cutting administrative salaries, including your own.
The stories of my compensation are greatly exaggerated.

When you began your job last year, your annual compensation was reportedly $828,000.
It actually was $600,000 until I cut my pay by $60,000. So my salary is $540,000, but it gets amplified because people say, 'You have a pension plan.'

What about your housing allowance? How much is the rent on your home in Oakland?
It’s about $10,000 a month.

Does U.C. pay for that on top of your salary?
Yes, and the reason they do that is because they have a president’s house, it needed $8 million of repairs and I decided that was not the way to go. Why the heck would I ever authorize $8 million for a house I didn’t want to live in anyhow?

Why can’t you have architecture students repair the house for course credit?
Let me ponder that.

What do you think of the idea that no administrator at a state university needs to earn more than the president of the United States, $400,000?
Will you throw in Air Force One and the White House?

While Yudof's response is clearly sarcastic, he obviously never substantively addressed why he is entitled to be paid comparably to the President of the richest country in the world.

We have written a few times about the travails of the University of California, some of its multiple campuses, and in particular its medical schools and teaching hospitals.  Most recently we have written about how leaders of its teaching hospitals also seemed to feel entitled to substantial compensation, including bonuses for "performance" even when their institutions were receiving bad publicity for quality problems (posts here and here).

Again and again we see examples of leaders of academic medical institutions, and health care organizations in general who seem to feel entitled to be judged differently, and rewarded differently than the common folk.  These entitlements exist even when the economy, or the financial performance of the specific organization prevents other people from making any economic progress. This entitlement exists even if those other poeple actually do the work, and ultimately provide the money that sustains the organization.


Although the executives of not-for-profit health care organizations generally make far less than executives of for-profit health care corporations, collectively, hired managers of even not-for-profit health care organizations have become richer and richer at a time when most Americans, including many health professionals, and most primary care physicians, have seen their incomes stagnate or fall. They are less and less restrainted by passive, if not crony boards, and more and more unaccountable. In a kind of multi-centric coup d'etat of the hired managers, they have become our new de facto aristocracy.

Or as we wrote in our previous post, executive compensation in health care seems best described as Prof Mintzberg described compensation for finance CEOs, "All this compensation madness is not about markets or talents or incentives, but rather about insiders hijacking established institutions for their personal benefit." As it did in finance, compensation madness is likely to keep the health care bubble inflating until it bursts, with the expected adverse consequences. Meanwhile, I say again, if health care reformers really care about improving access and controlling costs, they will have to have the courage to confront the powerful and self-interested leaders who benefit so well from their previously mission-driven organizations. It is time to reverse the coup d'etat of the hired managers.

Quintiles to More Heavily Directly Invest in the Drugs Which it Evaluates - But Not to Worry, Says an Expert?

The Associated Press just reported on the latest trend in commercially sponsored clinical research, direct investment by contract research organizations (CROs) in the development of specific drugs by particular pharmaceutical or biotechnology companies. Here is the background in the article:
Pharmaceutical companies previously did all their own research and testing and submitted the results to the Food and Drug Administration for approval to put a medication on the market.

Since the 1990s or so, Big Pharma has farmed out more and more of that testing to companies like Quintiles Transnational Corp., which grew quickly to meet the demand.
Now Quintiles is branching out...
Now Durham, N.C.-based Quintiles is the world's biggest contract research organization, and more than ever, it's using its deep pockets to entwine itself with the pharmaceutical companies, fronting them cash and services for a piece of the profits once a drug is approved.

Quintiles, which was created in 1982, upped the ante last month, saying it wants to invest even more in potential drugs as pharmaceutical companies grapple with the down economy. Quintiles is hoping its new investments will produce enormous payoffs in the future,....

Quintiles' decision to become more aggressive in taking investment risks comes at a time it's betting drug makers can use the resources it can offer, both cash and services.

'They're both currency for managing risk and having skin in the game,' said Ron Wooten, a Quintiles executive vice president who heads the company's capital investment group.

Controversy over creating the drug investment unit in 2000 was key in pushing Quintiles founder Dennis Gilling and several private-equity firms to buy out shareholders for $1.75 billion and take the company private again in 2003. Wall Street analysts complained they couldn't estimate what the drug investments were worth, prompting Gilling and others to decide the company's stock was undervalued.

The private company no longer publishes its profits. It claims revenues of about $3 billion a year. That's also about what Quintiles has invested in other drug companies.
Furthermore,

Quintiles appears to be uniquely positioned to both invest in and test potential medications. None of the half-dozen major shareholder-owned contract research organizations will have a drug-investment division after Wilmington, N.C.-based Pharmaceutical Product Development Inc. spins off its unit in a few months, Coldwell said.

The payoffs for the risk of developing a drug can be huge.

In 2002, Quintiles took a chance on Eli Lilly and Co.'s antidepressant Cymbalta. Quintiles said it invested $125 million in cash, then spent another $400 million on a sales force of more than 550 after the product launch. Cymbalta is now Lilly's second-biggest drug. Quintiles said it's brought in more than $700 million so far for a stream of royalties lasting to 2012.

Japan's Eisai Co. is hoping Quintiles' money and experience helps it double the number of potential treatments it can put through testing simultaneously

The article raised a concern that "the buffer between drug makers and testers are again blurred."

But not to worry.... Here is the response from Quintiles,
Wooten, the Quintiles executive, doesn't see his company's increased interest in bringing drugs to the market affecting its testing objectivity. Instead Quintiles is the outsider turning a hard eye on which pharmaceuticals will become profitable.

'It allows you to really get to the essence of the data that you're looking at instead of what you hope it says,' he said. There isn't 'the natural bias that you would have with your own babies.'

Furthermore, the AP reporter got reassurances from a noted academic expert in the area,
The FDA preserves the integrity of testing in a landscape already pockmarked with potential conflicts of interest that include company-sponsored academic research and investigators testing drugs while owning shares in companies that own the drug, said Kenneth Getz, a senior fellow at Tufts University's Center for the Study of Drug Development.

The FDA's view is that any company with a financial stake in a potential drug will face similar scrutiny from the agency.

'It's assumed,' FDA spokeswoman Karen Riley wrote in an e-mail, 'that drug/device/biologic companies who sponsor trials of pending products have a conflict because they will gain if the product is approved.'

Besides, pharmaceutical companies have navigated the tricky territory that comes with testing, Getz said. So have the companies like Quintiles that have taken on the outsourced work, he said.

'These potential conflicts of interest are ever-present, and the real question is how do companies manage these potential conflicts effectively,' he said. 'These are massive, massive companies that have thousands of staff that are not generally aware of a conflict of interest at a corporate level. They are paid to do a quality job that meets internal and regulatory guidelines or they are not going to keep their jobs.'

Here on Health Care Renewal, we have discussed how the conflicts of interest that are now pervasive in health care can adversely affect clinical care, teaching, and research.  We have looked at how clinical research sponsors, who have a vested interest in having the results favor the products and services they sell, may manipulate the design, implementation, analysis, and dissemination of research, and when all else fails, suppress unfavorable results.  We have also looked at problems with the ethics and quality of research done by contract research organizations, who are, after all, paid by companies again with vested interests in selling particular products or services.

Given all that, one may argue that having contract research organizations invest in particular drugs or devices which they are also evaluating through clinical research may not make things much worse.  However, at the least, it seems to me that it further obfuscates conflicts of interest that may lead to biased research results, dishonoring the patients who volunteered for the trials, and biasing the information on which patients and physicians make decisions.

Finally, I should note how Quintiles new investments in specific drugs was defended in the article.  The article quoted Quintiles executive vice president Ron Wooten suggesting that Quintiles might be able to be objective in making the original decision to invest in a drug. He conveniently did not address what might happen after the investment was made, when Quintiles was performing, analyzing, and reporting clinical research on a drug or device in which it had invested.

The article also quoted Kenneth Getz, the Senior Fellow at Tufts, who seemed unconcerned about the issue.  What the article did not mention is that the Tufts Center for the Study of Drug Development, at which Mr Getz is based,
receives unrestricted grants from pharmaceutical and biotechnology firms, as well as companies that provide related services to the research-based industry (e.g., contract research, consulting, and technology firms). These grants represent approximately 40% of Tufts CSDD’s operating expenses.
per the Center's web-site. Another page on the web-site lists Mr Getz's qualifications,
Kenneth A. Getz is a senior research fellow at the Tufts CSDD. Considered an expert on the investigative site and CRO markets, R& D management, ECT solutions adoption and clinical research volunteerism,....

Mr. Getz is the founder and chairman of CISCRP ....

He holds an MBA from the J.L. Kellogg Graduate School of Management at Northwestern University and a bachelor's degree, Phi Beta Kappa, from Brandeis University. Mr. Getz worked for over seven years in management consulting, where he assisted biopharmaceutical companies in planning and implementing drug development strategies. He is also the founder and former CEO of CenterWatch.

Note that Mr Getz seems to have no training in biomedical science, medicine, or health care.  Furthermore, CISCRP (the Center for Information and Study on Clinical Research Participation), has an advisory board (see their web-site here) that includes representatives of pharmaceutical companies (Vertex Pharmaceuticals, Biogen Idec, and Roche), and contract research organizations, (PPD Inc, and particularly, in this case, Quintiles). The vast list of the Center's "supporters" include a catalog of drug and biotechnology companies (including Abbott Vascular, Amgen, AstraZeneca, Biogen Idec, Daiichi Sankyo Pharmaceutical Development, Eli Lilly, Forest Laboratories, Genentech, Genzyme, GlaxoSmithKline, Janssen, Johnson and Johnson, Merck, Novo Nordisk, Novartis, Ortho-McNeil, Pfizer, Roche, Sankyo, Sanofi-Aventis, Serono, Shire, Takeda, and Wyeth), and contract research organizations, (including Covance, Parexel, PPDI, and notably again, Quintiles.)

So the other lesson from this bit of news is how the information the public, health care professionals, and policy makers  receive about health care policy is frequently shaped by people with horses in the race, but that such influences are rarely disclosed.  This article included an interview with a single apparently academic expert who provided reassurance that the conflicts of interest discussed in the article were not really so worrisome.  This expert, however, failed to disclose his own extensive, albeit somewhat indirect ties to a variety of corporations that might benefit from the conflicts discussed as the main topic of the article, including corporations that were directly involved in them (Quintiles and Eli Lilly).  Maybe because the reporter thought that the expert was unbiased, there was no attempt to find a contrasting opinion.

So I say again, again, again, health care professionals, policy  makers, and people in general need to be extremely skeptical of most of the apparently unbiased pronouncements made about medical and health care policy issues in the media.  It would be a small step toward a more transparent discussion if those who expressed opinions would also fully disclose in detail their relevant conflicts of interest.

Dissolve Away those Pesky Bones with Corn Oil

I just read an interesting paper from Gabriel Fernandes's group at the University of Texas. It's titled "High fat diet-induced animal model of age-associated obesity and osteoporosis". I was expecting this to be the usual "we fed mice industrial lard for 60% of calories and they got sick" paper, but I was pleasantly surprised. From the introduction:
CO [corn oil] is known to promote bone loss, obesity, impaired glucose tolerance, insulin resistance and thus represents a useful model for studying the early stages in the development of obesity, hyperglycemia, Type 2 diabetes [23] and osteoporosis. We have used omega-6 fatty acids enriched diet as a fat source which is commonly observed in today's Western diets basically responsible for the pathogenesis of many diseases [24].
Just 10% of the diet as corn oil (roughly 20% of calories), with no added omega-3, on top of an otherwise poor laboratory diet, caused:
  • Obesity
  • Osteoporosis
  • The replacement of bone marrow with fat cells
  • Diabetes
  • Insulin resistance
  • Generalized inflammation
  • Elevated liver weight (possibly indicating fatty liver)
Hmm, some of these sound familiar... We can add them to the findings that omega-6 also promotes various types of cancer in rodents (1).

20% fat is less than the amount it typically takes to make a rodent this sick. This leads me to conclude that corn oil is particularly good at causing mouse versions of some of the most common facets of the "diseases of civilization". It's exceptionally high in omega-6 (linoleic acid) with virtually no omega-3.

Make sure to eat your heart-healthy corn oil! It's made in the USA, dirt cheap and it even lowers cholesterol!

Dissolve Away those Pesky Bones with Corn Oil

I just read an interesting paper from Gabriel Fernandes's group at the University of Texas. It's titled "High fat diet-induced animal model of age-associated obesity and osteoporosis". I was expecting this to be the usual "we fed mice industrial lard for 60% of calories and they got sick" paper, but I was pleasantly surprised. From the introduction:
CO [corn oil] is known to promote bone loss, obesity, impaired glucose tolerance, insulin resistance and thus represents a useful model for studying the early stages in the development of obesity, hyperglycemia, Type 2 diabetes [23] and osteoporosis. We have used omega-6 fatty acids enriched diet as a fat source which is commonly observed in today's Western diets basically responsible for the pathogenesis of many diseases [24].
Just 10% of the diet as corn oil (roughly 20% of calories), with no added omega-3, on top of an otherwise poor laboratory diet, caused:
  • Obesity
  • Osteoporosis
  • The replacement of bone marrow with fat cells
  • Diabetes
  • Insulin resistance
  • Generalized inflammation
  • Elevated liver weight (possibly indicating fatty liver)
Hmm, some of these sound familiar... We can add them to the findings that omega-6 also promotes various types of cancer in rodents (1).

20% fat is less than the amount it typically takes to make a rodent this sick. This leads me to conclude that corn oil is particularly good at causing mouse versions of some of the most common facets of the "diseases of civilization". It's exceptionally high in omega-6 (linoleic acid) with virtually no omega-3.

Make sure to eat your heart-healthy corn oil! It's made in the USA, dirt cheap and it even lowers cholesterol!