Technology Environment Flashcards
Components of the Technology Environment
Hardware
* the actual servers (virtual and physical), network connections and devices used to
access information
Networks
* the wired or wireless connections that link the infrastructure together and enable
accessibility of the applications and patient data
Applications/Software
* the software used by administrative, clinical and support staff to process and store
data, manage patients’ records and provide information
Hardware
Mobile Devices
* Portable devices and wireless connectivity
* Handheld devices
* Carts
* Smartphones
Medical Devices
* Physiologic devices
* Laboratory devices
Tracking technology
* Bar codes and RFID
Audio and video
* Voice over IP (for telephones)
* Telemedicine
* Remote monitoring
Hardware
- Technology Infrastructure
- Store data, run applications and connect those applications and tools
- Servers
- Virtual or physical
- Alternatives:
- Application Service Providers (ASPs)
- Cloud computing – SaaS, PaaS, IaaS, etc.
- Data Storage
- Magnetic tape storage, optical disc, hard drive
- Cloud storage
- External device – Storage Area Network (SANs)
76
Applications/Software
What the end user works with, using a human-computer interface
* Clinical Applications
* Administrative Applications
* Financial Applications
* Consumer Applications
Information Security Challenges
- Rapid industry development and adoption of technology without always
considering security implications - Example: Medical devices designed to operate for 10-15 years, but running
software that will only be supported for 5-10 years. - High dependance on technology for all clinical and business operations
- High cost and levels of complication to deploy and maintain technology in a
secure manner
Security Best Practices
Purchase systems that have been well-architected in a secure manner
* New FDA guidelines have greatly increased security requirements for medical devices.
* Other technology solutions must be evaluated for fitness before purchase and deployment.
* Security practices are HIGHLY variable amongst vendors.
* Deploy new systems in a secure manner.
* Use secure system design principals, such as configuration baselines.
* Deploy antimalware and security monitoring tools.
* Keep a complete inventory of all systems.
* Deploy a secure, segmented network.
* Maintain secure systems
* Deploy security updates as soon as feasible. (Remember Wannacry?)
* Scan the environment for security vulnerabilities and remediate as soon as feasible
* Perform other security testing, such as network penetration tests
* NEW*: Department of Health and Human Services HICP Guidance
Disaster Recovery and Business Continuity
From an IT perspective, what is the plan should a worst-case-scenario play
out in which most or all IT systems are lost?
* Backups? Secondary failover data center? Failover to the cloud?
* Do you have a documented, current disaster recovery plan?
* What are the target recovery point objectives? (RPO)
* What are the triggers to initiate the disaster recovery plan?
* Have you rehearsed this DRP?
Privacy
First charge for EHR administration
* Patient’s data must remain confidential
* The Privacy of the Patient
* The Confidentiality of the Information
* Accounting of disclosures
* Levels of confidentiality (nurse or physician versus nurse’s aide versus
insurance provider)* Highly regulated, and will likely become more regulated in the future.
* HIPAA, GDPR, plus other state-specific privacy regulations.
* Systems must be designed and deployed in a secure manner that protects
patient privacy.
* Authentication
* Appropriately provisioned rights
* Logging of actions taken
Clinical Applications
Support patient care wherever it is being delivered
* EHR
* Picture archiving and communication systems (PACS)
* Specialized documentation systems (surgical, perinatal, etc.)
Overall goals
* Promote interoperability between these systems
* Patient safety
* High quality care
* Efficiency and lower costs
Clinical Applications: EMR
Electronic Medical Record (EMR)
* Continuous longitudinal record in one specific setting (e.g., providers office, a
hospital or home health service)
Scanned charts, HL7 Interface, Patient Lab Data, etc.
Data Integration/Interface Engines
Essential for a health information network to exist
* Interface engines permit disparate information systems to be connected
correctly – drive the systems, matching data and patients correctly
* Without, errors would occur in patient charts, care and billing
* Based on the HL7 standard for data interchange
* An absolutely-critical application on which nearly all other clinical
applications depend.
Administrative Applications
Provide support for clinicians as well as the administrative staff in an institution
* Types
* Electronic timecards
* Staff competency record keeping
* Scheduling - staff and patient
* Education applications
* Bed management systems
* Radio Frequency Identification Devices (RFID)
* Equipment tracking, out-of-bed detection or fall detection, monitoring patients
Financial Applications
Generally grouped as - Revenue Cycle Management
* Enterprise Resource Planning (ERP)
* Revenue Cycle
* Registration and Scheduling, Billing, AR, Contract Management
* Enterprise Resource Planning
* General Ledger (GL produces departmental revenue and expense reports as well as the organization’s
balance sheet), HR and Payroll, AP, Budgeting, Materials Management
* All managers need access to ERP modules including HR, budgeting, and revenue and expense
reporting
Data Warehouses
Storing data in a warehouse allows multiple systems to query the warehouse
and retrieve the data at the same time
* Data warehouses support quality reporting & research
* Define “at risk” populations
* Search for patterns of illness
Clinical and Business Intelligence (CBI)
- Consists of technologies, applications and practices for the collection,
integration, analysis and presentation of clinical information, for the purpose
of promoting better clinical decision-making - Continuous quality improvement
- Provider performance
- Population health
- Comparative effectiveness
Business Intelligence Tools - For example;
- Improve patient safety and patient care
- Analyze operating room use
- Analyze staff overtime patterns
Collecting Business Intelligence - Specific applications
- Data warehouses
Telehealth and Telemedicine
Two professionals communicating at a distance or a consultation from an
academic medical center to a rural hospital with a severely injured patient
* Requires broadband accessibility on both sides; video cameras with detailed
resolution capabilities, microphone, equipment that will directly transmit data
through the computer (e.g. blood pressure cuff and pulse oximeter) and the
ability to send radiology and lab results/reports
Benefits
* Increased access to specialized care to underserved areas
* Sometimes faster than face-to-face appointment
* Physician/clinician is included
* No driving
Quantum Computing
New field of computing that is still in development, but rapidly approaching
commercial viability.
* Very good at processing certain types of data and computations. Tens-ofthousands
of times faster than conventional binary computers.
* Will accelerate certain types of scientific functions, such as the creation of
new drugs, treatments, and diagnostics.
* Will simultaneously create new cybersecurity challenges!
Devices
- Personal Computers
- Continue to be the device of choice
- Connected via cable to network or wireless
- Point-of-Care Devices
- Handheld, tablet, mobile-cart PCs, smart phones
- Support clinician workflow
- Wireless connection
- Device Integration
- Integrated into software applications
- Cable or wireless connection to common networkTracking technology
- Bar codes and RFID
- Audio and video
- Voice over IP (for telephones)
- Telemedicine
- Remote monitoring
Network Infrastructure
- Wired network (Copper, Fiber)
- WLAN (Wireless Local Area Network)
- WAN (Wide Area Network)
- ISP (Internet Service Provider)
- VPN (Virtual Private Network)
- VoIP (Voice Over Internet Protocol)
- Leased Line for high volume
exchanges - MPLS (Multiprotocol Label Switching)
- ATM (Asynchronous Transfer Mode)
80
Information Security
Three areas of focus:
* Confidentiality – Ensuring that data is properly classified according to its
sensitivity and protected accordingly.
* Integrity – Data is not improperly modified or lost.
* Availability – Data remains available when and where needed. Systems
providing this data are designed in a sufficiently redundant and resilient
manner.