Microsoft Word - HC_Whitepaper.doc

Using Document Managementin a Healthcare Organization



www.imrgold.com

Using Document Management

in a Healthcare Organization

For HIPAA Compliance and Improved

Operational Efficiency

April 2003

A White Paper By Stephen H. Rannells

Senior Product Manager, Healthcare

Information Management Research Inc

W H I

E S

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Dramatic regulatory and economic changes in the healthcare industry are forcing every

organization in the healthcare business to re-evaluate the use, storage and retrieval of

patient health information. These changes not only impact large hospitals and

insurance companies; they also reach down into the business operations of private

physicians and clinics.

The objective of this white paper is to examine the current state of healthcare

information management systems, then demonstrate how organizations can use

document management to bring patient-related document storage and retrieval into

HIPAA compliance and at the same time improve patient safety and care, and

dramatically increase profitability and cash flow.

First, we will examine the state of healthcare information management systems and

understand some of the critical issues that could be barriers to compliance, patient

safety, and profitability.

Current State of Healthcare Information Systems

Healthcare organizations have the opportunity and responsibility to provide needed

medical treatment for patients from pre-birth to end of life. They provide services based

on patient need and the skills of medical professionals. At each step of the medical

care process, large volumes of paper and computerized information are gathered and

retained.

The information is captured and managed within two major categories:

•

Patient Billing Information

•

Patient Medical Records

Each category contains complex data storage and retrieval mechanisms, because it

must be referenced and updated by numerous departments and functions throughout

the healthcare organization. It is not unusual for a typical healthcare provider to have

more than thirty functions that impact these patient data records. Adding to the

complexity, many departments also make and retain their own files of patient

information, and may have their own unique patient identifiers and forms containing

relevant patient information.

Federal regulations are changing the way patient records and patient billing information

are stored, accessed and distributed. Healthcare organizations are not only looking for

ways to comply with the regulations, they are also looking for more efficient ways to

manage all the computerized and paper-based information.

Automation of the patient billing process in medical clinics, hospitals and long-term

care facilities has been developing for more than thirty years. Today most organizations

have a system to generate patient bills electronically and transmit them to payer

organizations for reimbursement. Any organization that cannot prepare electronic bills

internally will usually outsource this function to billing service providers.

At each step of the

medical care process,

large volumes of paper

and computerized

information are gathered

and retained.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



The next frontier for automation has been the patient registration process. This is the

data input phase for both the patient billing system and the patient care medical record,

and for most organizations this phase creates a tremendous amount of paper that

cannot be managed by the health information management system (HIMS). The paper

problem must be addressed, because it causes inefficiency, inaccuracy, redundancy and

inconsistency, and it is very difficult to insure patient privacy for the information that is

not under the control of the HIMS. A document management strategy can address

this issue.

Surprisingly, only a small percentage of hospital organizations have fully implemented a

clinical records system that creates a true electronic medical record (EMR). Recent

reports show 72% of hospitals have no EMR, with only 21% having a full EMR

. This

data implies that 80% of the organizations are using a mix of electronic information

systems alongside a combination of computerized and paper-based patient records.

These disparate systems, which result in multiple databases, paper files and

inconsistent formats, make patient information retrieval inefficient and costly.

When healthcare organizations evaluate new information technology today, their

decisions are driven by the following priorities (in order), all of which are made even

more difficult to achieve by the HIPAA regulations:

Patient safety

Quality of care

Improvement of cash flow

Market share

Reduction of expenses without reducing critical personnel

These priorities will drive information technology expenditures in the years to come.

Recent studies have shown that significant efforts are underway to address these using

technologies that create and manage computerized patient records.

Computerized Patient Records

20%

40%

60%

80%

100%

Workflow Automation

Transfer of Images

Data Repositories

Patient Info Access

Implemented

In Process

Pending

Planned

Surprisingly, only a small

percentage of hospital

organizations have fully

implemented a clinical

records system that

creates a true electronic

medical record (EMR).

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



The Problem of Disparate Systems

With the complexity and multitude of departments in a typical healthcare organization,

the diversity of medical professionals, and the varying rate of adoption of computer

technologies, most organizations have a potpourri of disparate patient record

methodologies and automated systems installed. It is not unusual to have more than

fifteen different systems in a medical clinic and over one hundred in a full healthcare

organization.

The systems include patient billing, ancillary departmental systems in radiology,

laboratory, heart diagnostics, pharmacy, surgery, emergency room, room and bed

assignments, dietary purchasing and many more. Each system may produce information

relating to a patient and the patient’s care, which becomes a permanent part of the

patient healthcare information. The databases created by each area, whether

automated or not, must be accessed on occasion to provide requested information

about a patient, a medical service provider, or a process or procedure in the

organization.

It is not unusual to have hundreds of requests per month requiring retrieval of multiple

forms or reports from many departments and data repositories in the organization,

offsite or onsite, remote or local. Because the information is all over the place, the total

cost and time to retrieve this information can be measured at most organizations in the

thousands of dollars and hundreds of hours of people’s time. A document management

strategy can significantly reduce this cost.

Patient Billing Records

The information obtained at patient registration is quickly entered into a format to

collect the charges for services and products used throughout the patient care history.

This information is used as the key patient identifier for all subsequent documentation

created during diagnosis and treatment, and is a common practice throughout the

healthcare system from a Physician’s office, clinic, ambulatory center or a full

care facility.

The patient billing record becomes the receptacle for all cost-based information relating

to the care of the patient. These patient charges are collected in the patient billing

databases and maintained until patient discharge when the bills are completed for

patient private payment or submission to the patient’s insurance company.

Patient

Financial

Records

Patient

Care

Provided

Patient

Bill

Patient

Registration

Insurance

Verification

Patient

Discharge

Patient

Record

Encoding

Transmitted

For payment

Patient

Record

Transcription

Billing Office

Patient Care Area

Emergency Room or

Registration

Charge

Master

Or printed for

private payment

It is not unusual to have

more than fifteen

different systems in a

medical clinic and over

one hundred in a full

healthcare organization.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



All or part of the patient billing process may be automated to produce electronic

medical bills, suitable for printing for payment or transmitting to the reimbursement

organization. Federal and state regulations mandate that patient bills must be retained

for many years in either electronic, microfilm or paper form. A document management

strategy can provide the most affordable and secure method of retention.

Patient Medical Records

Immediately upon completion of the patient registration process and movement of the

patient to the patient care area, a patient medical record is initiated. It documents all of

the initial health-related questions asked of the patient or guardian, a record of the

initial symptoms and description of the patient’s desire for medical care.

Upon presentation to a medical professional, a battery of initial tests and qualifications

are performed to establish the base case for the medical record. These initial results

along with all further testing, procedures, medical professional notes, results, charts or

other pertinent information are stored in the medical record.

It is not unusual for a physician’s clinic to have up to 100 different forms and

information documents. A full healthcare provider such as a hospital or long term care

facility may have

hundreds

of different forms and documents in the medical record. All

of this data must be retained for up to 28 years, in a file that is accessible for retrieval

and reporting by authorized healthcare personnel. A document management strategy

can provide an affordable method for data retention.

A typical patient medical record flow might include all or part of the following steps and

databases, based on the patient care procedures:

Electronic

Medical

Records

Patient

Care

Provided

Paper

Medical

Record

Historic

Patient

Information

Patient

Registration

Patient

Discharge

Patient

Record

Encoding

Patient

Orders &

Scheduling

Paper

Results or

XRAY

Record

Pharmacy

Dispensing

/Dosage

Record

Paper

Results of

Lab

Results

Other

Paper

Charts or

Documents

Human

Resources

Resource

Scheduling

Patient

Record

Transcription

Patient Care Area

Departmental Databases

Patient

Bill

Ancillary

Patient

Records

A document management

strategy can provide an

affordable method for

data retention.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Depending on the individual organizational policies, none, part or all of the medical

record may be electronic. As seen earlier, surprisingly few medical facilities have a full

Electronic Medical Record (EMR) solution in use today. Most organizations have some

electronic records augmented by vast storage rooms of paper records, loosely organized

by some patient identifier. Paper records are costly to store, prone to misfiling or loss,

and notoriously difficult to secure for compliance. Locating all the historical records for

complicated cases can consume a tremendous amount of time. A document

management strategy can convert the paper into digital documents. This will improve

responsiveness to regulatory requests, and increase cash flow by speeding up

responses to insurance requests for supporting information.

Payer Organizations

Upon discharge of the patient, a patient bill is prepared, or in the case of a long-term

care facility, an interim patient bill is prepared for payment from a variety of sources. It

could be a private pay situation by the patient or some related party, one or more

insurance companies with whom the patient is contracted, a governmental agency that

provides payment for patient care, or a combination of all these organizations.

In the case of a payer organization, following is a general picture of the information

flow and the required processes and databases.

Most of the payer organizations have an automated billing system for the

reimbursement of patient bills with large databases of patient and member information,

along with employer contracts. A document management strategy can integrate paper-

based records and electronic databases by providing common identifiers to streamline

retrieval.

Patient

Bill

Insurance

Information

Member

Information

Patient

Information

Reimbursement

Statement

For

Patient

Transmitted

For payment

Insurance

Verification

Procedure

Evaluation

Procedure

Reimbursement

Pricing

Procedure

Pricing

Diagnostic

Group

Information

Insurance

Contract

Information

Transmit

payment info

to provider

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



The HIPAA Effect

The Health Insurance Portability and Accountability Act of 1996, better known as HIPAA, is a

new standard in the U.S. medical community for the collection, storage and

transmission of patient information between providers (doctors, hospitals, clinics and

the like), payers (insurance companies and the U.S. Government) and clearinghouses

(centralized processing facilities that improve the efficiency of the system). In the past,

there wasn’t enough standardization between payers and providers, which resulted in a

lot of human intervention throughout the insurance claim processing system. HIPAA is a

move to standardize the entire process, which will allow for more computerization,

reduce processing costs, improve timeliness of information and reduce insurance fraud

while at the same time protecting patient privacy.

Because HIPAA will increase the use of computers, there is an increased risk of anyone

gaining unauthorized information about patients, hospitals, doctors, drugs and the like.

HIPAA requires stringent security standards for anyone who may have access to this

information anywhere along the chain of information processing, from the doctor’s

office all the way through to the large insurance companies.

Typical HIPAA Requests for Protected Health Information

In a HIPAA compliant environment, a typical Protected Health Information request could

result in the requirement to retrieve the data from several data repositories throughout

the healthcare organization, with each repository requiring:

•

Authentication of the requestor’s right to receive the information

•

An authorized person to generate the request to retrieve the designated

record group

•

Access restrictions of any person retrieving the designated information

•

Auditing the access to it

•

A continual status report for the person who initiated the request into the

organization.

There is a deadline to deliver the data to the requestor. Under HIPAA, thirty days is the

deadline to deliver all on-site information. If off-site information is required, the

deadline is extended to sixty days. Within that timeframe, all the designated data

records for that particular request are brought together into one patient report. Failure

to meet these timeframes could result in sanctions and penalties. The requestor must

be given the finished report for their use.

Without a document management strategy in place, retrieval and compilation of this

disparate information is very costly and time-consuming. For example, one organization

that receives over 900 requests per month must pay up to $50 per request (or $45,000 a

month) just to retrieve the information from multiple departments.

ithout a document

management strategy

in place, retrieval and

compilation of this

disparate information

is very costly and

time-consuming.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



The information request flow in a typical HIPAA environment would go as follows:

Summary of Issues

The overwhelming amount of paper-based information and the problem of disparate

information management systems are huge barriers to 1) increasing patient safety

while improving the quality of patient care, 2) increasing profitability and improving

cash flow, and 3) fully complying with HIPAA,

and

doing all this at the same time. A

document management strategy can help healthcare organizations break through the

barriers and achieve these objectives in a reasonable timeframe.

Applying Document Management to the

Healthcare Environment

Traditionally, electronic document management software (EDMS) in all industries

(including healthcare) has focused on eliminating or reducing the paper problem. Basic

features included scanning, indexing, a security system for access, managing the

storage, archive and retrieval. Over time, EDMS expanded to include group

collaboration on active documents (e.g. Word), workflow, forms management and Web

content management. As a result, many EDMS solutions have become increasingly

complex to deploy and expensive to maintain.

Information

Request

under

HIPAA

Document

Request

Workflow

Creation

Authorized

Requestor?

Department

Retrieves

Requested

Information

Department

Retrieves

Requested

Information

Department

Retrieves

Requested

Information

Medical

Records

Patient

Financial

Records

Ancillary

Patient

Records

Document

Request

Completed

Paper

Medical

Record

Paper

Results or

XRAY

Record

Request Input Template

Role–Based Security

Status

Messaging

Information

Provided to

Requestor

Request

Database

Historical

Requests

Fulfilled

Data Request

Workflow Mgmt

Historical

Activity

Logging

Audit Logging

of Access

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



A typical electronic document process has two major phases in its lifecycle, as shown

in the following figure:

Source: Gartner Group

The first phase involves the active document: its creation, revision and approval. Most

organizations already have methods in place for this. The second phase is the fixed

document that has reached a point where a version is ready to be saved and managed

through to destruction. This phase is often referred to as ‘archival’ or ‘records

retention’. It is in this phase that the vast majority of healthcare organizations lack an

efficient solution and face the problems outlined in the table below.

The remainder of this paper will focus on the implementation of basic document

management functionality for aggregation, archival, access and destruction.

Basic document management software can be used to address several of the problems

previously discussed.

Problem

Benefits of Document Management

Patient safety and quality of care Faster, more available and more accurate

information can save lives!

Insuring the privacy of Protected

Health Information that currently

exists in paper form (HIPAA)

A digital repository can enforce roles-based

access control; data is encrypted.

Meet HIPAA information request

deadlines

Can reduce each request from days to

minutes; can reduce personnel time spent;

can compile diverse data into one report.

Servicing information requests

from insurance companies

Faster and more accurate retrieval = reduced

expense and improved cash flow.

Enormous amount of paperwork

generated

Convert paper to digital and reduce paper

storage requirements.

Disparate databases Data and documents can be aggregated

and archived together for easier privacy

management and faster, more accurate

retrieval.

Data retention/archival Ensure fast access to archived records;

automate record destruction.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Case Study:

University of Louisville Hospital

Given all the forms and documents generated in a typical hospital, managing the

massive amount of information with an eye towards HIPAA compliance is no easy task.

The University of Louisville Hospital selected Alchemy document management software

from Information Management Research (IMR) Inc. "In the HIPAA compliance world, we

believe Alchemy, with its new role-based access control and audit tracking features,

will continue to be very efficient for retrieval of the patient health information under its

control,” said Walter Zupances, RHIA, CPC-H, and the Director of Health Information

Management for the Hospital.

Alchemy creates a secure archive of patient information, including medical images,

paper-based documents, forms, enterprise reports, email, and hard-to-access legacy

system data. It manages the information in a centralized and secure location, all

addressable by common identifiers. And compared to complex enterprise imaging

products, Alchemy is a snap to install and end users love its friendly interfaces.

Nearly three years ago, the University of Louisville Hospital installed an Alchemy

Premium solution that included the Alchemy Web Server (to allow access to information

via a web interface) and the Alchemy Scan extension (to add paper documents from 21

workstations). Since then, the medical center has saved hundreds of thousands of

dollars and thousands of employee hours.

The economy of storage space was one of the first benefits realized. Staff members

scan approximately 350 documents per day into several databases, the largest of which

is 12 gigabytes. The billing department used to have a 30-foot by 20-foot room devoted

to file storage. Now, instead of expanding their storage—as most other hospitals are

doing—the storage space they need is shrinking, freeing valuable space for other uses.

"We've saved many thousands of dollars in storage costs alone," says Michael Boston,

the clinical system analyst. "We have to pay a monthly fee for a lot of the paperwork

that isn't stored at the hospital. That fee is being reduced dramatically now that new

files no longer need to be stored at a remote facility.” In addition, the employee who

used to be in charge of maintaining the on-site storage area has been reassigned to

other tasks, saving the hospital many person hours.

One of the greatest overall benefits is the economy of time and efficiency for hospital

personnel. Physicians and nurses no longer have to wait hours for a patient's chart to be

pulled from the Medical Record department for details on the patient's last ER visit.

They just look it up in Alchemy, which takes only minutes. And the billing office

dramatically reduced unnecessary repeat telephone calls, simply by looking up patient

registrations in Alchemy, where copies of the patient's insurance card are stored.

The hospital also maintains a database for the National Bone Marrow Donor Program.

The program must save information that goes back as far as 10 years. With paper

records, this was difficult to search through. But now, locating crucial documents from

the Alchemy repository is almost effortless.

One of the greatest

overall benefits is the

economy of time and

efficiency for hospital

personnel.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Many Healthcare Organizations Utilize The Alchemy

Document Management System

More than 150 organizations in the medical and healthcare industry use Alchemy today

in a diversity of ways. The product has been used throughout the organizations to store,

index and retrieve many types of documents, images and forms with excellent results.

The applications run the gamut from the departmental capture of signed patient

registration forms, to the scanning and archiving of full medical records for retrieval and

reporting. Alchemy is used by physicians and nurses to quickly retrieve patient care

information. It is also used by I/T to reduce paper storage and to provide a secure

repository.

Alchemy was designed as a secure document and record management system, and

contains many features that provide significant benefits to healthcare organizations and

help them comply with HIPAA (or other) security and privacy standards.

•

A security system integrated with the Microsoft Active Directory. This provides a

single sign-on capability where employee access can instantly be added to or

removed from the system.

•

Computer users who have access to the storage area cannot view the contents of

the database, unless the system administrator grants them permission.

•

Security levels within each database allow separate access capabilities at the

administrator and user group levels.

•

Password protection at the database, folder and file level.

•

Read-only clients that prevent the modification of data in the system.

•

The database can be stored in a highly encrypted manner.

•

The Alchemy Windows server can manage access to hundreds of databases;

however, each user is limited to see only his or her authorized databases. Full text

searches are limited only to the authorized databases.

•

Secured databases (or subsets) can be archived to removable media (e.g. CD, DVD)

for remote access, compliance with records retention policies, or for disaster

preparedness purposes.

•

In disaster recovery situations, it is possible to become completely operational

within minutes using removable media, even at a new location.

•

The read-only client can also be added to the removable media. If a disaster wipes

out the central data store, end users such as nurses and ER workers can load the

media in a laptop computer and have immediate access to the data.

•

IMR and its worldwide partners network offer end user and administrative training

classes to teach customers about all of the security aspects of the product line.

New Features Strengthen HIPAA compliance

In 2003, IMR is further enhancing Alchemy with new features that will help healthcare

organizations more fully address the privacy and security portions of HIPAA regulations.

More than 150

organizations in the

medical and healthcare

industry use Alchemy

today in a diversity

of ways.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Role Based Access Control (RBAC)

HIPAA requires the system to control security based upon each person’s assigned

responsibilities within the organization. The RBAC feature is designed primarily for an

organization where different departments can do different things up the chain of

command, each higher level having more capabilities than the one below it. The primary

need for this capability is to be able to prevent unauthorized use of the information and

to be able to correct errors in emergency situations.

Document Request Management

A request for information in a HIPAA controlled environment may result in multiple

requests for documents and information from several departments or even offsite

locations, all to be supplied in a given timeframe. The status of the completion of the

request must be monitored by the requestor for timely completion to present the full

response to the requestor.

Document request management enables the generation and completion of the request

in singular, straight-line processing or multi-thread concurrent processing by several

departments. The status will be tracked and completion notification sent to the

requestor.

IMR will also offer document routing templates so predefined processes can be invoked

based upon the type of information request that has been received by the Medical

Records Administrator or the Healthcare Privacy Officer to retrieve designated data

records.

Audit Trails

HIPAA requires detailed audit records about the source of documents, who has had

access to the documents and how the documents have left the system, either by

transmission methods or deletions. The Audit Trail feature records information about

each user of the system: when they logged on, what function they performed on the

patient information stored in Alchemy, and when they logged off. In addition, any

security violations such as attempted retrieval or other unauthorized activities will be

recorded.

The audit logs can be retained for an indefinite period of time. The logs cannot be

modified and will provide active involvement capability of the Alchemy administrator to

insure the audit log files don’t get too large and are archived in an efficient manner.

Recommendations are to archive the audit logs in a separate Alchemy database. A

reporting tool will be provided to show all activity by user, by record, and all failed

security attempts to enter any database.

Medical Imaging Document Viewing

DICOM is a medical industry standard for viewing CAT scans, MRIs, X-rays and other

digital medical imaging. A DICOM viewer will be added to the product.

Document request

management enables the

generation and completion

of the request in singular,

straight-line processing or

multi-thread concurrent

processing by several

departments.

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Typical Document Management Configurations

Small Department or Office Configuration

Where one person can handle the aggregation and capture of information and the

management of one repository, and up to 25 clients can retrieve and view the data. This

configuration does not require a dedicated server.

Search Clients

Build Workstation

Repository

Word processing,

spreadsheets,

other PC Apps

Legacy system data

(DataGrabber)

Radiology

Viewer

Imaging

Application

(Scan or other)

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Large Department or Multi-department Configuration

A larger organization can utilize the Windows Server scalable system. Up to 250 users

can contribute data to multiple repositories. Up to 250 users can have read-only access.

The new HIPAA compliant features discussed above can be installed. A Web server can

be added for remote access.

Premium

Build Workstations

Word processing,

spreadsheets,

other PC Apps

Legacy system data

(DataGrabber)

Radiology

Viewer

Multiple imaging

Applications

(Scan or other)

Alchemy Premium Server

Role Based Access Control option

Document Request Management option

Audit Trail option

Repository

Access controlled by Alchemy server

www.imrgold.com

IMR White Paper Series: Using Document Management in a Healthcare Organization



Professional Services

Creating and implementing a successful healthcare solution will require careful

planning and definition: which particular documents to manage, a sensitivity to HIPAA,

the roles to be defined, and the people and processes put into place to facilitate the

effective use of the products. Each installation will need a professional services group

to maximize the application and insure optimal return on investment. Professional

services will include training the key users, configuring the servers, and installing the

document routing and templates.

Summary

The overwhelming amount of paper-based information and the problem of

disparate information management systems are huge barriers to:

Increasing patient safety while improving the quality of patient care,

Increasing profitability and improving cash flow,

Fully complying with HIPAA,

And doing all this at the same time

A document management strategy can help them break through the barriers

and achieve these objectives in a reasonable timeframe. The Alchemy product

family provides the basic document management features needed to achieve

these objectives, and does so at a dramatically lower price point than other

document management or imaging products.

For more information about document management solutions in the healthcare industry

and to view a list of IMR’s healthcare customers, please visit the IMR Web site at

www.imrgold.com or call 1-303-689-0022.

Source: HIMSS/AstraZeneca Clinican

Wireless Survey, 2002

Sources: Modern Healthcare’s Information

Systems Survey, 2002

PricewaterhouseCoopers, Zinn Enterprises

About the Author

Stephen H. Rannells is the Senior Product Manager for Healthcare at IMR Inc. He has a

long history and significant experience in the healthcare industry. He held executive

client service positions with healthcare industry vendors IDX, QuadraMed and the

Siemens/SMS consulting group. While part of the Humana Hospital group and the

Kindred Health Network, Mr. Rannells was instrumental in defining healthcare data flow

and information requirements. As a consultant with Price Waterhouse Coopers

Consulting Management Group, he consulted on the workflow process changes for

Integrated Data Networks at large hospitals. His contacts and experience prepared him

to understand the great need for better document management in the healthcare

industry.