Imprivata Cortext: Secure Communications Platform For . - Microsoft

Transcription

WHITE PAPERImprivata Cortext: Secure CommunicationsPlatform for HealthcareSponsored by: ImprivataLynne A. DunbrackMay 2014INTRODUCTIONAt the heart of excellent patient care is good communication between care team members. However, ahighly mobile workforce and multiple communications channels — voice, landlines, mobile devices,email, and paging — make it challenging for clinicians to communicate efficiently. Fragmentedcommunication and information handoffs can result in suboptimal workflows that adversely affectpatient care. In fact, The Joint Commission's Sentinel Event database reveals that poor1communication is the root cause in nearly 70% of reported sentinel events.Healthcare delivery and health management have always been communication intensive. Enabling thedemand for real-time communication and collaboration is the growing use of personally owned mobiledevices by healthcare professionals who have become accustomed to easy-to-use communicationand collaboration tools in their personal lives and see the potential value of using these tools withcolleagues and care teams to improve the quality, cost, and experience of care. As healthcareprofessionals become increasingly connected via their lightweight mobile devices (e.g., smartphones,tablets, and convertibles), real-time communication and collaboration is feasible.This IDC Health Insights white paper, sponsored by Imprivata, presents key findings of interviews withthree healthcare IT executives regarding the deployment of Imprivata Cortext, a securecommunications platform, and includes use cases and best practices. The three executives representAtlantic Health System, Carolinas Pathology Group and Celligent Diagnostics, and Beaufort MemorialHospital. Consistent findings across the three healthcare organizations are as follows: ease of useleads to quick clinician adoption, there is broad application of secure communication across varioushospital workflows, and instant communication can save time for care team members and can improvecollaboration.1Joint Commission on Accreditation of Healthcare Organizations. Sentinel Event Alert. Joint Commission onAccreditation of Healthcare Organizations, Issue No. 30, 2004. Oak Brook, Ill.May 2014, IDC Health Insights #HI248818

COMMUNICATION CHALLENGES AND OPPORTUNITIESToday, healthcare professionals use a number of different channels to communicate with each other;many of them are distracting and take healthcare professionals away from direct patient care, such asin-person meetings, telephone calls, and faxing. Some are secure, and others present vulnerabilitiesthat could lead to violations of privacy and security policies. Each channel has its own challenges: Voice calls and paging without the awareness of presence (i.e., is the person available to takea call) are particularly prone to disrupt clinical workflows. This needlessly delays responsesand frustrates senders and recipients as frequent multiple missed calls and callbacks arerequired to reach the parties who need to communicate and/or confirm for the sender that therecipient received the message. Overhead paging can be disruptive to patients and is ofteninefficient as it assumes the paged party is in the building. Also, many organizations usealphanumeric/text pagers, which are unencrypted and could also present a risk of violatingHIPAA similar to SMS. Native mobile phone text messaging is fraught with potential security, documentation, andpatient safety issues if used to communicate about patient care. Because native textmessages are sent and stored as clear text to cell phones that may not be password protectedor remotely erased in the event of reported loss or theft, personally identifiable healthinformation may be visible to anyone who picks up or steals the device. To avoid violatingprivacy and security policies, some clinicians will try to communicate about a patient withoutdivulging identifiers. This may lead to possible miscommunication between caregivers and thepotential for patient safety issues such as misidentifying the patient being discussed andadministering the wrong medication or dosage. Email can also be unsecure unless it is sent through secure channels such as a portal orencrypted, a step that can often be cumbersome because of third-party add-ons or a separateapplication or service, especially if the application is poorly designed or implemented. Theasynchronous nature of email also presents communication delays because checking emailthroughout the day is not part of the regular workflow for many busy clinicians.The consumerization of technology is driving the adoption of mobile devices by clinicians whoincreasingly want to avail themselves of the full range of capabilities that mobile devices offer.Convenient communication is at the top of the list, specifically the ability to send text messages.Despite policies against texting PHI and the risk of steep HIPAA penalties, nearly one out of fourphysicians admitted to using the native text capabilities of his or her smartphone to send textmessages to colleagues and patients (see Figure 1). 2014 IDC Health Insights#HI2488182

FIGURE 1Current Use of Text Messaging by Physicians: Native Versus SecureQ.Do you currently use any of the following technologies to communicate with your colleaguesabout patient care?Q.Do you currently use any of the following technologies to communicate with your patients?26.9Native text capabilities of mymobile device26.511.5Third-party text messagingapplication to send text messages7.301020(% of respondents)30ColleaguesPatientsn 234Source: IDC Health Insights' Connected Health Physician Survey, 2013No doubt, some physicians who are using a corporate-liable device assume that all applications andfeatures of the smartphone, including native texting and instant messaging, have been secured by ITand approved for use in a clinical care setting. Only 11.5% of physicians use a secure texting solutionto communicate with colleagues.The growth in accountable care organizations (ACOs) will underscore the need for bettercommunication channels to support care coordination across the continuum of care to reducehealthcare costs and improve the patient experience and quality of care. New payment models andgrowing case mix complexity require health professionals and teams to communicate and collaboratemore quickly and seamlessly with colleagues within the enterprise. For the first time, care teams mustperform as tightly knit multidisciplinary teams that collectively prioritize their efforts and resources ondelivering better outcomes in less time and at a lower cost. Since these multidisciplinary acute andpost-acute care teams more often than not span multiple organizational boundaries, care professionalsand teams also need to communicate and coordinate care beyond the enterprise walls, which requirescollaborative communications technology. 2014 IDC Health Insights#HI2488183

IMPRIVATA CORTEXT: A SECURE COMMUNICATIONS PLATFORMImprivata delivers authentication management and secure communications solutions for healthcare toimprove provider productivity for better focus on patient care. Imprivata OneSign, the company'sintegrated single sign-on, authentication management, and workflow automation platform, enablesfast, secure, and more efficient access to clinical applications, roaming desktops, and other healthinformation technology systems. Imprivata Cortext, a secure communications platform for healthcare,enables providers to securely send text, photo, and group messaging from their smartphone, tablet, ordesktop to improve care coordination and communications. Imprivata has a robust ecosystem oftechnology partners that includes major electronic medical records vendors such as Epic, Cerner,MEDITECH, McKesson, and Siemens and a number of leading infrastructure providers such asVMware, Citrix, HP, and Dell as well as leading alerting and scheduling applications such asConnexall, Extension Healthcare, HIT Application Solutions, and Amion. Founded in 2001, Imprivata isbased in Lexington, Massachusetts, and currently has more than 900 healthcare customers and 2million licensed users globally.Imprivata Cortext enables providers to coordinate care easily from their smartphone, tablet, orworkstation across multiple healthcare organizations. All messages, contacts, directories, and settingsare synced in real time across all of the provider's devices. This ensures fast and accuratecommunication across a number of healthcare-specific workflows. Imprivata Cortext is designed towork inside and outside the hospital so that providers can communicate from anywhere using a WiFi ora cell connection. Through the Imprivata Developer program and partner APIs, Imprivata Cortext canintegrate with the healthcare organization's existing alerting, scheduling, EMR, or other systems,enabling users to receive, acknowledge, or escalate clinical alerts, lab results, and other contentsecurely to their mobile device or workstation.Imprivata provides a simple approach to onboarding large groups of new users into the system.Administrators can synchronize their Active Directory or import users directly into Imprivata Cortext viaa CSV file or directly into the cloud. Once added, invitations are sent to users with a unique identifier toensure that only authorized users can access Imprivata Cortext. Once the user has set up his or heraccount, he or she is able to send and access messages across any device, with a real-time syncacross all devices (smartphone, tablet, or workstation). Imprivata provides services options forcustomers, which assist with end-user training, enrollment, and adoption.Text messages are sent securely using TLS or SSL connections with AES 256-bit and RSA 2,048-bitencryption. Data at rest is secured on mobile clients and on the server using AES 256-bit encryption.The communication infrastructure is hosted securely in the cloud via Amazon Web Services. Imprivataprovides a Business Associate Agreement for every organization that uses Imprivata Cortext (whetherthe free version or a paid subscription) and has been verified for HIPAA compliance by an independentthird party. For additional security, administrators can opt to protect the application with a personalidentification number (PIN). 2014 IDC Health Insights#HI2488184

A native desktop application is available for nurses and allied health professionals who may not beallowed to use their personal mobile devices for communicating with colleagues. The recently releasednative desktop application for PCs/Macs enables nurses to keep Imprivata Cortext running in thebackground with an icon in the systems tray and pop-up alerts that appear when people want tocommunicate with them.A secure texting solution is available for free to physician practices and clinics. Customers can enrollfor free via the Imprivata Web site and then download Imprivata Cortext from the Apple App Store orthe Google Play Store. The free version of the solution provides text, photo, and group messaging aswell as multisite communication, standard support, and 30-day message archiving.The enterprise version, designed for hospitals, health systems, and accountable care organizations, isavailable on a subscription basis with tiered pricing based on the number of users. In addition to thecore features of secure text, photo, and group messaging on the free version, the enterprise versionadds features such as a native desktop application that is integrated with Imprivata OneSign;persistent alerts and custom sounds; multidevice support with real-time message synchronization; anAPI for interoperability with alerting, scheduling, EMR, and other applications; enterprise support; andextended message archiving.Imprivata Cortext is evolving from a secure texting solution to becoming a communications softwareplatform that healthcare organizations can extend to meet their communications and collaborationneeds. Through the Imprivata Development Partnership program and partner APIs, Imprivata Cortextcan be integrated with a healthcare organization's existing paging, alerting, or on-call schedulingsystems, enabling users to receive clinical alerts, lab results, and other content securely on theirmobile device or workstation — further embedding Imprivata Cortext into clinician workflows.IMPRIVATA CORTEXT USE CASES AND CUSTOMER PROFILESAtlantic Health SystemAtlantic Health System is one of the largest nonprofit healthcare organizations in New Jersey, with1,339 licensed beds, 12,114 employees, and 3,168 physicians. The health system consists of6 hospitals: 4 acute care hospitals, a children's hospital, and a rehabilitation hospital. Atlantic Health'sACO was formed in 2010 and was selected in 2012 to participate in the Medicare Shared SavingsProgram. Atlantic ACO is one of the largest ACOs in the nation, with more than 1,400 participatingphysicians and Atlantic Health's member hospitals in the provider network serving a seven-county areain New Jersey.The decision to go with Imprivata Cortext for secure texting was an easy one for Atlantic Health, as thehealthcare organization is a long-standing user of Imprivata OneSign and has been an Imprivatacustomer since 2004. Like most healthcare organizations, Atlantic Health feared that healthprofessionals were texting PHI to one another despite policies that prohibited native texting.Imprivata's launch of Imprivata Cortext provided Atlantic Health the opportunity to address this securityissue with a vendor with which it was comfortable working. 2014 IDC Health Insights#HI2488185

Atlantic Health does not have a formal BYOD policy. Physicians typically use their own devices (mostlyiPhones). However, 300 to 400 physicians employed by Atlantic Health are provided corporate-liablesmartphones, as are the nurses. Nursing management was concerned about Atlantic Health's liability ifa nurse's personal phone was broken while it was being used for work (e.g., it was dropped or infectedwith malware). Covering the costs associated with increased texting was also a factor; would AtlanticHealth need to provide a monthly stipend or allowance for increased data and text plan fees?In early 2013, Atlantic Health rolled out Imprivata Cortext to 70 physicians participating in the pilotprogram. Rollout occurred department by department for physicians and unit by unit for nurses whoused Imprivata Cortext from their desktop. Today, more than 1,100 users are communicating withImprivata Cortext.The first use cases for Imprivata Cortext are related to the disposition of patients and communicationbetween physicians and between physicians and their staff. Imprivata Cortext can accommodatemultiple directories. Atlantic Health System has one directory across all four hospitals. The ACOmanages a separate directory. Ambulatory clinics and physician practices may also set up their owndirectories using the free version to add users who are not part of the Atlantic Health System or ACOdirectories. These searchable directories enable PCPs to locate specialists within the network andrefer patients to them, thus facilitating access to specialty care. An ER physician or hospitalist can useImprivata Cortext to alert a patient's PCP that his or her patient is being seen in the ER;improved communication could reduce unnecessary hospital admissions. AtlanticHealth System's pharmacists are also using Imprivata Cortext to communicate with"From anhospitals to verify medication dosage, prescriptions, and therapeutic orders.While most nurses use Imprivata Cortext from their desktop computers, one of AtlanticHealth's hospitals rolled out Imprivata Cortext for nurses to use from their corporateliable smartphones so that they could communicate with attending physicians,hospitalists, and other nurses. The technology enables them to expedite securecommunications across clinicians and physicians within their required workflows andallows them to spend more time treating their patients. Before Imprivata Cortext wasdeployed, communication would have occurred in person, by phone, by pager, or, inthe worst-case scenario, via native texting.Atlantic Health is also exploring how the ACO will use Imprivata Cortext. The first usecase contemplated is referrals between PCPs and specialists. End users are alsocreating their own use cases as they gain experience using Imprivata Cortext andbecome familiar with its benefits. Frank McKenna, Atlantic Health System's CorporateDirector of Customer Services & Information Security, Information Services & Support,commented, "From an organic standpoint, it starts the 'light bulb effect,' with a criticalmass of users creating use cases at the operational level." The next rollout will targetcoordinators as well as home health and long-term care as the organization continuesto expand the product to specialist groups. 2014 IDC Health Insights#HI248818organicstandpoint, itstarts the 'lightbulb effect,'with a criticalmass of userscreating usecases at theoperationallevel." —Frank McKenna,CorporateDirector ofCustomerServices &InformationSecurity,InformationServices &Support,Atlantic HealthSystem6

Carolinas Pathology Group and Celligent DiagnosticsCarolinas Pathology Group is a 30-physician anatomical pathology group that provides comprehensiveanatomic, clinical, and molecular pathology services to 5 health systems, 2 large cancer centers, and12 individual hospitals in the Carolinas as well as hundreds of group practices across the nation.Carolinas Pathology Group also owns its own independent lab, Celligent Diagnostics, that processesspecimens for thousands of customers along the eastern seaboard.The primary objective for seeking a secure texting solution was to address the inherent challenges thepathologists faced communicating among themselves as well as with referring physicians locatedacross the region. They wanted to facilitate point-of-care decision making. But the pathologists did notwant email on their iPhones, which were provided by the group. They did want the ability to send avideo or an image of the specimen for a consult. (FDA regulations prohibit pathologists from makingdiagnoses from a digital image. However, they can provide a second opinion after reviewing one.)Thus the Carolinas Pathology Group began looking for a secure texting solution.Carolinas Pathology Group evaluated other secure texting solutions but turned to Imprivata, in part becauseone of Celligent's customers, Spartanburg Regional Healthcare System, uses Imprivata OneSign in itshospitals and ambulatory practices, and the pathologists knew people using Imprivata OneSign. Jared G.Block, M.D., Medical Director of Flow Cytometry for Carolinas Medical Center as well as the LaboratoryMedical Director at Celligent Diagnostics, was a driving force in using Imprivata Cortext. CarolinasPathology Group found that Imprivata provided an optimal balance of technical and clinical expertise.Carolinas Pathology Group uses a combination of BYOD and corporate-liable devices; the split isapproximately 20% BYOD and 80% corporate liable. Smartphones provided by Carolinas PathologyGroup are primarily iPhones. IT appreciates that in addition to ensuring secure communication of PHI,Imprivata Cortext provides a single point of management from a dashboard console. For example, ITdoes not have to go around to every single phone to update Imprivata Cortext.Imprivata Cortext was rolled out as a pilot program starting with a couple ofphysicians that are heavy smartphone users. Through word of mouth by the powerusers, more users would download and begin to use Imprivata Cortext, includingmidlevel clinicians. Carolinas Pathology Group found the ability to support midlevelsto be an important differentiator between Imprivata Cortext and other secure textingsolutions. And because Imprivata Cortext is designed for communication betweenmultiple organizations, inter-facility consults and referrals are simplified."You can't put aprice tag ontransparencywhen it comes tocommunication."— Jared Friends,Director ofMarketing andClient Retention,CelligentDiagnosticsTo date, the core communication for the pathologists — because they areremoved from the patients — is around consults, second opinions, and dailycommunication. The primary use cases are consults and referrals. The mainbenefits that Carolinas Pathology Group has achieved include the ability toreduce various communication barriers for both clinicians and administrators.Jared Friends, Director of Marketing and Client Retention for Celligent Diagnostics, commented that"you can't put a price tag on transparency when it comes to communication." 2014 IDC Health Insights#HI2488187

Carolinas Pathology Group is also evaluating several future use cases: Consult cases: A potential referring physician will be able to go to the Carolinas PathologyGroup Web site; search for a pathologist by specialty type, education, or location; and havethe option to send the pathologist a text via "Cortext" asking his or her opinion on a potentialconsult case. Physicians could securely send the potential consult to the pathologist viaImprivata Cortext. Historical content: Imprivata Cortext allows the administrator to mine historical data in realtime, presenting opportunities for analytics around cost and quality of care. An alternative to enterprise instant messaging applications: All 140 employees in theCarolinas Pathology Group, as well as the Celligent Diagnostics network, have use of theinstant messaging application of a large software vendor. Clinical staff members who use bothapplications (especially the users with the mobile and desktop applications) prefer to useImprivata Cortext for their private clinical conversations because of security and functionality.Beaufort Memorial HospitalBeaufort Memorial Hospital, based in Beaufort, South Carolina, is a 197-bed community hospital withover 200 physicians on staff. The largest hospital between Savannah and Charleston, South Carolina,Beaufort Memorial Hospital provides a wide range of medical services including emergency medicalservices. The hospital has been using Imprivata OneSign, an integrated access management solutionfor single sign-on and authentication, and Imprivata Cortext for over two years.The majority of Beaufort's physicians, even employed physicians, use their own smartphones. Thehospital provides an annual stipend for the smartphone. Approximately half of the physicians useiPhones; the remainder use mostly Android smartphones, with a modest number of physicians usingWindows or other smartphones.Beaufort uses Imprivata Cortext to streamline the following workflows: Code STEMI. When a catheterization lab is activated, time is of the essence to alert thepercutaneous coronary intervention (PCI) team that a patient is being sent from theemergency department and needs to be prepped for the cardiologist. Nurses in the ER canactivate the code team for a STEMI in order to prepare for surgery. CMS requires thathospitals meet Code STEMI within 60 minutes. Prior to Imprivata Cortext, nurses pagednumerous team members in order to reach them and waited for them to call back. Radiology. Radiologists use Imprivata Cortext to alert attending physicians that the requestedradiology report is available or to send text and picture messages to specialists. Prior to usingImprivata Cortext, radiologists would call or page specialists who in turn would have to locatean available workstation to access the electronic health record to view the medical image andthe corresponding radiology report. Anesthesiology. Anesthesiologists are highly mobile, moving between operating rooms andcatheterization labs. Imprivata Cortext enables them to receive secure text messages thatinclude not only current medications and recent lab results that could create a patient safetyissue but also updates about when they can expect patients to be prepped for surgery andadministration of anesthesia. 2014 IDC Health Insights#HI2488188

Hospitalists. Nurses use the Cortext Desktop Application to send messages to the attendinghospitalists' smartphones. Nurses can see at a glance whether the hospitalists received andopened the messages, while hospitalists could visually prioritize their messages within their"traffic" and clinical workflow.Prior to using Imprivata Cortext, clinicians and their staff relied on paging and telephoning tocommunicate with one another. This resulted in inevitable delays as clinicians waited for theircolleagues to call them back and repeated paging when they did not respond in a timely fashion.Beaufort Memorial Hospital rolled out Imprivata Cortext en masse rather than bydepartment or communication group as other Imprivata customers have electedto do. The hospital took this approach in part because Beaufort's physicians aretechnically savvy and would actively encourage their colleagues to use ImprivataCortext so that they can securely text each other.Today, more than 100 physicians and 250 total healthcare professionals,including advanced licensed professionals, nurses, unit secretaries, andadministrative staff, are using Imprivata Cortext to solve communication workflowissues between physicians, unit coordinators/secretaries and physicians, nurses,and physicians and nurses. Some of the call groups are using Cortext to respondto a patient situation quickly. For example, using Cortext has streamlined theability to activate a call team for the catheter lab. A marketing campaign directedat nurses is under way. Office-based physicians are also using Cortext. Theresponse from clinicians has been very positive, according to Ed Ricks, VicePresident and CIO: "One of the satisfied physicians commented, 'Finally you'redoing something for us instead of to us.'""One of thesatisfiedphysicianscommented,'Finallyyou're doingsomething forus instead ofto us.'" —Ed Ricks, VicePresident andCIO, BeaufortMemorialHospitalBeaufort will continue to expand its use of Imprivata Cortext to take advantage ofnew features as the product evolves.ESSENTIAL GUIDANCERolling Cortext Out Across the Enterprise: Where to Start?When new technology is rolled out to clinicians, it can be tempting to target the more technically savvyclinicians who are willing to embrace new technology. There are advantages to this approach. Earlyadopters of technology understand that pilots of beta versions are intended to shake out issues andwill provide constructive feedback for improving the technology. Power users will become clinicianchampions who will encourage their colleagues to use the new technology. But these power users aretypically not representative of all users, so a pilot program that includes a combination of power usersand novice, but enthusiastic, users will provide greater insights into how the new technology will bereceived and potential issues that need to be overcome for widespread user acceptance. 2014 IDC Health Insights#HI2488189

Reaching clinicians to educate them about texting policies and new tools available to address securityconcerns related to mobile device use can be very challenging. Many physicians do not have emailaddresses or do not check their email frequently because they are focused on caring for their patients.Our research shows that beta and early customers used posters and flyers, in addition to email, to getthe word out about Imprivata Cortext. IT staff attended clinical staff meetings and shift changemeetings to bring communication groups on board together. They also made themselves available inlunch or break rooms to help clinicians who needed assistance installing Imprivata Cortext on theirmobile devices.Best Practices and Lessons LearnedThe customers and executives interviewed for this document identified the following best practices andlessons learned as they rolled out Imprivata Cortext throughout their organization: Start with IT staff using Imprivata Cortext. Customers often started with the IT department tofine-tune their deployment approach and identify any usability or training issues that mightneed to be addressed before Imprivata Cortext was rolled out more widely. A unique byproduct of this approach is that customers discovered that Imprivata Cortext allows IT staff tocommunicate with clinicians or one another about IT support issues that require protectedhealth information to be sent along to resolve the issue (e.g., the patient's name and medicalrecord number to search for a problematic electronic health record). Roll out Imprivata Cortext by communication workgroups or department. A common approachto deploying clinical applications is to roll them out by department. For smaller healthcareorganizations, such as ambulatory practices, this approach may be appropriate. However, inlarger healthcare organizations, healthcare services are delivered by multidisciplinary teamsthat can consist of emergency physicians, radiologists, anesthesiologists, surgeons, nurses,and other allied health professionals. In these facilities, Imprivata Cortext should be rolled outto clinical teams or groups of clinicians that regularly communicate with each other.Therefore, one of the first steps toward a successful deployment of Imprivata Cortext is tounderstand the communication workgroups. Who are they? What do they need? What types ofcommunications are not being served by notes in the EMR? With whom do care teammembers communicate? This team approach creates the necessary critical mass amongclinicians who regularly communicate with each other, which in turn will increase the utilizationof Imprivata Cortext. Clinical staff and shift change meetings are good venues for identifyingcommunication groups. Develop a structured approach to deploying Imprivata Cortext along with a communicationcampaign. IT executives commented that because Imprivata Cortext was intuitive, the rolloutwas relatively informal, with invitations to enroll emailed to users. A more structured approach,including project mana

VMware, Citrix, HP, and Dell as well as leading alerting and scheduling applications such as Connexall, Extension Healthcare, HIT Application Solutions, and Amion. Founded in 2001, Imprivata is based in Lexington, Massachusetts, and currently has more than 900 healthcare customers and 2 million licensed users globally.