Epiphany Healthcare Blog

From the desk of the President: Focus on cybersecurity 

The number of bad actors, the seriousness of damage, and the frequency of threats continues to increase in healthcare cybersecurity.  Healthcare and medical devices are under attack.  Managers must consider cybersecurity when maintaining and upgrading their medical devices.

Healthcare Ransomware, Data Breaches, Represent Top Industry Threats (from the 2017 HIMSS Cybersecurity Survey) by Elizabeth Snell, Thinkstock

75% of the 239 healthcare respondents said that their organization experienced a significant security incident in the past 12 months.  Nearly all of those entities (96%) were able to identify the threat actor.

37% of healthcare respondents that experienced a security incident in the past 12 months said it was due to an online scam.  20% of those surveyed attributed the attack to a negligent insider, with another 20% said a hacker caused the issue.

55% of those surveyed said their organization has a dedicated or defined amount of the budget for cybersecurity needs.

The 2017 HIMSS Cybersecurity Survey Final Report found:

•  Patient Safety is the #1 Concern
•  Data Breach is the #2 Concern
•  Spread of Malware is the #3 Concern

Epiphany Healthcare customers have often, in the past, waited to upgrade their systems until their operating system or browsers reached end of life.  This strategy may have been OK six or seven years’ ago.  It is not today.

Today, our software has evolved with a tremendous focus on the escalating cybersecurity threats and is much more secure than the software deployed six or seven years’ ago when the constant threat did not exist.

We contract with consultants to identify system vulnerabilities.  Those vulnerabilities that can be patched are released for the current version.  Vulnerabilities that cannot be patched are addressed in the next release.  This is an ongoing process to keep up with the evolving security threats.

In summary, current versions of Epiphany’s Cardio Server are far more secure than versions from six years’ ago.  Epiphany strongly recommends that every time you add a new module or feature, include a software upgrade in your purchase.  The software is included in your annual support agreement, you only pay for project management and technical engineering to implement the upgrade.  It is the prudent course to take in today’s world.

In 2004, Epiphany opened its doors with a goal to be vendor-friendly and integrate with as many different devices as possible to best support our customers’ complex needs. We are always looking to expand our compatibility list. 2017 marked a record-breaking year as we added over 100 new device integrations!

• Increased the Number of Supported Diagnostic Devices from 150 to 260
• Expanded the Number of Modality Types Supported from 15 to 23
• Developed New Relationships with Device Manufacturers, increasing them to over 80
• Refined Our Internal Process to Support New Device Integrations
  

What Does This Mean for You?

• Cardio Server is Flexible, Making it an Ideal Enterprise Solution
  • If your organization is an enterprise system with multiple hospitals, clinics, and different devices, Epiphany has the ability to customize your Cardio Server to work with them.
• Use Only One Application to Manage Multiple Diagnostic Devices
  • If you purchase new devices for your hospital, there is no need to purchase additional management software. New modalities are easily added to an existing Cardio Server system.

We Want to Integrate with Your Devices!

• Epiphany already integrates with 23 different modality types. However, if your hospital’s device(s) are not listed, let us know!
• Submit your integration inquiry to our Product Manager of New Ventures here and we will determine and notify you if your diagnostic device can be added to our growing list of compatible devices.
• Have questions about your devices? Chat live with our Product Specialist to get answers in real-time.

Discover Your Organization’s Potential with Cardio Server

Want to learn more about how Cardio Server will integrate with your devices? Let's talk! 

With over 850 hospital customers worldwide and a commitment to providing exceptional customer service, discover why Epiphany's Cardio Server is the fastest growing ECG management system on the market today.

Have you heard of National Doctor’s Day?  This national holiday took 58 years to become more than just a local holiday.  National Doctor’s Day is celebrated on March 30th in the United States and praises physicians for the work they do supporting their patients and their communities.  On this day, Epiphany would like to take a moment to thank each and every provider for their diligence to detail, timely diagnosis, and passion for the wellness of their patients who are our family.

The first Doctor’s Day can be traced back to a small town in Georgia called Winder.  On March 30, 1933 Eudora Brown Almond, the wife of a prominent Georgian doctor, wanted to create a day to recognize and honor doctors.  She mailed greeting cards to all of the doctors she knew and even placed flowers on the graves of deceased physicians. The flowers she placed on the graves of these doctors that are still used to celebrate National Doctor’s Day today are red carnations.

Even though this day was celebrated locally since 1933, it wasn’t a national holiday until Congress passed Proclamation 6253 in 1991.  March 30th was chosen because Dr. Crawford W. Long used an ether anesthetic for the first time on this day during surgery in 1842.

Epiphany would like thank the many providers who utilize Cardio Server on this special day.  We love hearing your feedback whether it be the ease of access from anywhere on any device including computers, tablets, or mobile devices or feedback regarding our features such as our advanced calipers.

We are happy to serve over 850 hospitals allowing providers to devote more time with their patients and less time on the clerical tasks.  Happy Doctor’s Day to each of you!

Managing a multiple-hospital, enterprise-wide IT infrastructure is challenging. Epiphany offers broad flexibility to hospitals in this situation. 

Hospital groups usually have legacy devices from multiple manufacturers and want to avoid the expense of replacing these products. Epiphany is compatible with 260 devices from over 80 manufacturers supporting 23 diagnostic modalities, so you can leverage your existing devices, workflow, and infrastructure.

Our customers have shared that in multiple-site systems, each hospital needs to be able to define its own workflow. Epiphany supports the ability to adjust Cardio Server to fit different workflow preferences for each site in a multiple-hospital implementation. Examples include:

1. Epiphany migrates data from your legacy management systems and uses that data to provide serial comparison reports on diagnostic test results from different manufacturer‘s devices.
2. HL7 messages, including order updates, preliminary results, image updates, final results, and billing messages, are transferred between multiple applications. For example, Cardio Server supports customized results for Epic, Cerner, Meditech, McKesson, and all other major EMR vendors.
3. It is common in multiple-site hospital systems for patients to have different patient IDs from different sites. Cardio Server identifies a patient's previous studies, even if they were performed with a different patient ID in another site, by using patient name and date of study and other unique identifiers of your choice.
4. Cardio Server can be configured to not require order linkage for outpatient and clinics studies, but to require orders for inpatient procedures. With our system, you can add not only your hospitals but your clinics and physician practices as well.
5. Some physicians confirm studies within the exercise stress application. Epiphany enables those stress studies coming from the hospital/clinic to be received as “confirmed” and pass onto the EMR while allowing physicians at the other sites to confirm using Cardio Server.
6. For university hospital systems, Epiphany has a workflow for cardiology fellows. The cardiology fellows receive a “usertype” unique to them that does not contain the ECG’s preliminary interpretation from the cardiograph. In this way, they are able to provide an unbiased interpretation before the reading MD confirms their work on the study. There is an additional option of a “training” version of Cardio Server, which strips interpretations from the ECGs, de-identifies patient information, and creates an archive of ECG training files for future use.
7. Multiple time zones are supported for enterprises that extend beyond a single time zone.

Epiphany values feedback from our customers. Listening and learning from our customers has allowed us to be active, adapt, and expand the functionality of our products to be flexible in supporting multiple-site enterprises.

An enterprise hospital using Cardio Server in Alabama contacted us to look for a way to improve their ECG billing workflow.

OPPORTUNITY FOR IMPROVEMENT

For ECG interpretations, there are two bill types: technical and professional. In this particular hospital’s case, the staff would manually change the study status in the EMR to generate the technical component of the bill.  

Of course, if any part of an organization’s workflow is manual, there is always a chance of inconsistency or clerical errors. At times, their manual process led to the hospital not billing the technical fee for performing an ECG. The hospital was losing revenue because, in their EMR, the trigger for dropping the technical charge required that the order status needed to change. In their previous workflow, this was a manual entry, it did not change automatically, and, therefore, the technical bill occasionally was not dropped. The hospital staff realized there was room for improvement and asked Epiphany if there was a way to automate this process. Epiphany’s answer was “absolutely.”

RESOLUTION

Epiphany now sends an order-status update message from Cardio Server automatically when the study is promoted to Unconfirmed. When Cardio Server sends the automatic update, the EMR changes the order status, which triggers the bill for the technical charge.

Patricia Brewer, an Epiphany Project Manager who worked with the hospital on the implementation, adds, “We are passionate about solving our customer’s problems here at Epiphany and this workflow fix is one of the many things we can do with Cardio Server’s flexibility to better the customer’s use and appreciation of our product.”

The resolution in Cardio Server for this hospital’s problem is not an uncommon request. This type of workflow improvement is what we at Epiphany work to achieve daily. When you calculate the time spent manually entering status change, in addition to lost revenue, automating the process with the help of Cardio Server and your EMR is substantial. If your EMR is able to accept an order-status update message, we can leverage that information to customize your Cardio Server configuration. Sign up for a complimentary workflow analysis to find out how Epiphany can improve clinical workflow for you.

What is it? Auto-reconciliation. You spend a lot of time manually reconciling studies to orders for tests performed before an order has been placed. We know that. It is a time-consuming, laborious process. We know that too.

With Epiphany’s Cardio Server, your studies automatically reconcile even if an order is sent after the test has been performed. This is a big deal as other ECG management systems can only offer a manual reconciliation process. A manual process involves many tedious steps to link a study to an order, these are extra steps that waste your valuable time.

Cardio Server can reconcile on patient ID, patient name, and date of study. If these fields do not suit your needs, different fields can be used for reconciliation—the settings are configurable based on your preference.

Emergency Department Benefits

Cardio Server enables a workflow where an emergency department physician makes a full interpretation of the study before an order is placed. When the order comes in and matches to the study, it is automatically confirmed. The reading physician does not have to take another look at the study. This is extremely important as most ECGs in the emergency department are initially completed before an order is placed. This process also helps with the hospital’s door-to-balloon time protocols because the ECGs are confirmed by a physician immediately upon receipt.

No add-on is required for this type of workflow; auto-reconciliation is something our application has been able to do for years. Auto-reconciliation is included with Cardio Server’s default configuration and the settings can be tailored to your needs. Cardio Server’s order reconciliation process greatly reduces manual workflow steps saving clinicians valuable time.

A Letter to Wally Pruitt, Implementations Director at Epiphany Healthcare from Mitch Ainsworth, PACS/Radiology Systems Administrator at Delta Regional Medical Center in Greenville, MS

Wally,

Now that we are a couple of weeks into our go-live, I feel like I can take a moment to catch my breath and put my thoughts on paper about our implementation experience. Epiphany was tasked with implementing Cardio Server in a very short time frame. We communicated our aggressive time-line requirements; the Epiphany team heard our needs and was able to implement Cardio Server to meet them. 

The team you assembled for this project was the best I have ever worked with. Bob Sturgill was instrumental in keeping the Epiphany team, as well as the DRMC team, on task to meet this deadline. Bob went above and beyond by scheduling time with just he and I to ensure certain milestones were met on time. Bob leaned on his contacts from Mortara to aid in integrating the stress and Holter systems with Cardio Server. Victor Villafaña worked tirelessly with our interface architect to ensure stable HL7 integration with Meditech. Victor also accommodated several changes just prior to go-live and a few optimizations after go-live. The trainer was exceptional as well. Tammy was well prepared to ensure we did not skip a beat while transitioning from Cerner Powerchart ECG to Cardio Server. During a very stressful time for our organization, Tammy kept both the ECG techs and physicians calm and focused while learning the new system.

The professionalism and work ethic of all involved from Epiphany should be commended. I never once felt that we were just another number on a sales sheet.

Your staff made the DRMC team feel as though we were part of a bigger team. The entire team was focused on effectively implementing a system that would aid in how we care for our patients as an organization. The Epiphany staff seemed as vested in this endeavor as we were. I have been involved in several other implementations that did not go so well. Other vendors we have worked with put their best people in sales. After the sale, the customer experience was terrible. From conversations with other colleagues, this seems to be the norm these days. Epiphany deserves to be applauded on this project. From sales to post-live support, it has been a wonderful experience. I feel sure there are a few people that I failed to mention but I appreciate their work on this project too. 

It is not often that the customer is treated as well as we were by Epiphany and you deserve to be praised for it. We are very satisfied with the quality of the system and how smoothly the system was implemented.

Thank you and your entire team at Epiphany for the hard work and dedication during this project.

Kudos to Epiphany!

Mitch Ainsworth RT(R)(CT)(ARRT) PACS/Radiology Systems Administrator Delta Regional Medical Center

About Delta Regional:

Founded in 1953 and based in Greenville, Mississippi, Delta Regional Medical Center is a 325-bed facility that is recognized as the leader in the delivery of quality care in the area. Delta Regional Medical Center’s purpose is to provide high quality medical services to the citizens and communities in the Tri-state Delta Region at the lowest practical cost and be a leader in providing needed support services to healthcare providers and patients to improve the health of the communities they serve.

I became Support Manager at Epiphany in 2016 after working in technical support for Epiphany and learning the application. With 18 years’ experience in IT support, I know that a great product without great technical support loses customers to competition. Both factors, great product and great support, have to be in place for customer retention.

When I took over as manager, I found that Epiphany’s technical support team, like many other technical support teams, focused on closing metrics. My experience taught me that closing cases as fast as possible does not always satisfy our customers.  Instead, using this method could lead to repetitive support calls on the same problem. I needed to change that metric and mentality to increase customer satisfaction and customer retention.

We changed the focus in our team. We asked them to slow down and focus on individual customer calls to thoroughly understand the root of the problem and not just the symptom of the problem. Focus on solving the root cause of the problem.

When our support technicians slow down, they spend more time discussing and understanding the customer’s environment and workflow requirements. They get to the root of the problem. They also spend more time documenting their findings and solutions. Greater understanding and documentation results in solutions that are leveraged by other team members when a different customer calls with a similar problem. 

A further step in our changed process was the implementation of the ‘round-robin’ support model. Previously, support calls would get assigned to whomever was available. With a close-as-fast-as-possible mentality and metric, technicians were motivated to close support calls without digging down to the root cause. Once solved, they were assigned another support call and another support call and another support call. With round robin, there is an equal distribution of calls amongst the support technicians. Some cases are simple and some complex. The technicians spend more time getting to the root cause on both the simple and complex calls. When they are finished with the simple cases, they have time to thoroughly document their work and time to clear out any backlog.

Epiphany has a great product that makes a difference in people’s lives. Our job as a support team is to provide you, our customer, with great support. Customers under support represent 95.5% of our total installed base.  We are focused on it; will continue to do so.

Jeff Drabek Epiphany Healthcare Technical Support Manager Office/Primary:(919) 354-5021 jeffdrabek@epiphanyhd.com

The U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) defined national standards to ensure the privacy of patients’ medical records and personal health information.

Healthcare Data Security

In August 2017, the HIPAA Journal cited measurable breaches in data security for the healthcare industry. Some of the findings revealed:

[B]etween January and June 2017, there have been 233 reported data breaches. Those breaches. . . impacted 3,159,236 patients. The largest reported breach in the first half of the year resulted in the theft of 697,800 records and was caused by a rogue insider, 1 of 96 incidents involving insiders. Out of those 96 incidents, 57 were due to insider error (423,000 records) and 36 incidents due to insider wrongdoing (743,665 records).

This disturbing data implies outside/hacker breaches are less of a threat than non-compliant behavior by your own employees.

Minimizing Risk: Healthcare Security Data Breaches

It is up to your organization’s IT staff to minimize security risks involving equipment that utilizes the latest technology, which includes mobile and off-site access to patient data (such as cardiology and pulmonary diagnostic test results). Epiphany’s engineering team has tested our application and put processes in place to prevent healthcare security data breaches.

What You Can Do

• Apply data encryption to active and inactive data.
• Control and monitor all log-ins; train users to log-off when not using applications.
• Epiphany’s Cardio Server has a customizable, automatic log-off feature to protect PHI.
• Educate employees and make them active participants in your program to reduce security breaches.
• Regular training and awareness regarding security are good, constant reminders to keep guards up and maintain skepticism towards phishing scams (emails or phone calls requesting suspicious information).
• Deploy applications that provide comprehensive HIPAA logs.
• Put firewalls in place to control employees’ access to at-risk websites.
• Use secure application program interface (API) technology with authentication and encryption; all points of entry into the system should be tested and documented.
• Offer secure, remote access to information for physicians.
• Enable secure, single sign-on using Active Directory.

Epiphany and its products align with best practices for today’s security standards. Read our Information Technology FAQs to learn more about ways we can work together to minimize healthcare security breaches.