Public Health Surveillance and Meaningful Use Regulations: A Crisis of Opportunity

Abstract

The Health Information Technology for Economic and Clinical Health Act is intended to enhance reimbursement of health care providers for meaningful use of electronic health records systems. This presents both opportunities and challenges for public health departments.

To earn incentive payments, clinical providers must exchange specified types of data with the public health system, such as immunization and syndromic surveillance data and notifiable disease reporting. However, a crisis looms because public health’s information technology systems largely lack the capabilities to accept the types of data proposed for exchange.

Cloud computing may be a solution for public health information systems. Through shared computing resources, public health departments could reap the benefits of electronic reporting within federal funding constraints.

You never want to let a serious crisis go to waste… . It’s an opportunity to do things you could not do before.

—Rahm Emmanuel, former White House chief of staff

Public health faces an impending crisis in health information technology. The Health Information Technology for Economic and Clinical Health (HITECH) Act¹ aims to automate health records in the United States. The administration of President Barack Obama, continuing an effort launched by President George W. Bush, supports the measure, which is administered by the Office of the National Coordinator (ONC) for Health Information Technology. This program provides funding of up to $30 billion to facilitate adoption of health information technology, most of it for direct reimbursements to clinicians and hospitals as an incentive for adoption. The efforts of advocates on the ONC’s Health Policy Advisory Committee led to inclusion in the initial federal regulations for reimbursement of expenses related to medical records adoption specifications designed to enhance 2-way communications between the clinical and public health sectors. Initial requirements specify transmission of data to public health departments on either immunizations or syndromic surveillance by individual health care providers, notifiable conditions or syndromic surveillance by hospitals, and specific data where required by state law.² Providers are also required to provide data to the Center for Medicaid and Medicare Services on a variety of quality indicators that may have public health implications, such as rates of delivery of smoking cessation interventions and the degree of control of hypertension in a provider s practice. Unfortunately, the program has created unfunded mandates that worsen financial strains on state and local health departments.

Providers who meet meaningful use specifications,³ as further defined in rulemaking, are eligible for payments of up to $44 000 per Medicare provider and up to $63 000 per Medicaid provider.¹ However, if providers ignore this rule, beginning in 2015 substantial penalties (starting at 1% reduction in reimbursement and increasing to 5% by 2020) will be imposed. The legislation provides for the secretary of the US Department of Health and Human Services to make the criteria for meaningful use of electronic health records more stringent and extensive as the program evolves. Federal rulemakers divided meaningful use into stages 1, 2, and 3; criteria for stage 2 are targeted to be fully implemented by 2014 and for stage 3 to begin in 2015.⁴ Because the meaningful use regulatory framework extends beyond initial adoption to ongoing use of electronic health record systems, it provides a strong lever to encourage clinical care providers to integrate their information flows with public health departments.

Meaningful use regulations pose a significant challenge for public health officials: they require public health institutions to be able to receive data transmissions in forms specified by ONC. This is likely to become a substantial problem because of the many types of health information technology (IT) systems, the number of different providers, the relative immaturity of standards, and the costs of becoming compliant with these requirements. If public health departments are not able to support connectivity, health care providers and hospitals in their jurisdiction are exempted from requirements to provide data to these departments.²

Furthermore, meaningful use requirements are designed to evolve rapidly: in stage 2, scheduled to begin in 2014, public health departments are expected to be able to receive data regularly from clinical providers for notifiable conditions, immunizations, and syndromic surveillance. In stage 3, beginning in 2015, electronic health records systems with new capabilities, such as the ability to work with public health alerting systems and on-screen “buttons” for submitting case reports to public health are envisioned.⁴ Public health departments will be required not just to upgrade their systems once, but also to keep up with evolving changes in the clinical care system prompted by meaningful use regulations.

The size of the task facing public health departments to manage receipt of data from the clinical care system is daunting. With more than 5000 individual hospitals (> 3700 independent hospitals)⁵ and more than 230 000 physician practices in the United States,⁶ each of which might require a unique connection to 1 or more public health departments at the state and local levels, the task of building an integrated infrastructure is significant. Even with anticipated consolidation of practices and hospitals through health information exchanges, it will be costly and difficult. Furthermore, the requirement for continual evolution of the types of communications proposed for meaningful use adds to the problem. Each connection between public health departments and clinical care providers may need to be revised several times as requirements evolve. Where are state and local public health departments to find the funds to adapt their IT systems to this massive and constantly evolving data stream?

Data from a recent survey by the Association of State and Territorial Health Officers suggest that public health departments are ill prepared to meet even the initial requirements for surveillance systems.⁷ Fewer than 45% of state health departments reported being ready to test receiving meaningful use data on syndromic surveillance. Rates of reported readiness for testing of notifiable diseases and immunization data were higher, but additional work is needed. The most common obstacle, as might be expected (37 of 48 respondents), is a lack of funding. The benefits of upgrading to be able to receive messages from meaningful use are not clear: one survey respondent said,

Updating our [ELR] infrastructure … will cost over $100 000 including re-certification… . Updating … will not provide any real benefit to us as the Public Health Department.^7(p13)

Local health departments likely face even greater challenges in responding to meaningful use. A recent National Association of City and County Health Officials survey of local health departments found that 72% identified insufficient funding among their top 3 barriers to system development.⁸ However, money is not the only problem. Lack of time or resources to divert from current programs and responsibilities was a top barrier to system development for 55% of survey respondents.

A further problem is growth in the volume of data that will come to the public health systems. Estimates from the Indiana Health Information Exchange suggest that automation of reporting for notifiable diseases will increase the volume of reported diseases about 4 to 10 times over that of manual reporting.⁹ New systems and work flows will be needed to process these reports, for example, automating access to electronic medical records to facilitate case investigation. Increases in the volume of data for syndromic systems could be much greater. Many local agencies with functional systems only receive syndromic data from a few hospitals in their jurisdiction.

Demands on immunization registries also will increase, because providers are essentially mandated to report immunizations to registries, potentially overwhelming existing infrastructure. New kinds of capabilities are also envisioned for later stages of meaningful use, such as linking electronic health records with chronic disease registries, buttons for reporting of notifiable diseases, and vaccine forecasting.⁴ Therefore, public health readiness for meaningful use requires more than a 1-time investment: it requires ongoing upgrades of public health infrastructure.

LACK OF INFORMATION TECHNOLOGY FUNDING

The authors of the HITECH Act envisioned the need, and authorized funding, for government infrastructure to work with the enhancements to the private sector systems funded through HITECH.¹⁰ However, it is apparent that funding for public health IT infrastructure has not been a priority for ONC or even the Centers for Disease Control and Prevention (CDC). During the transition period between administrations, CDC developed a plan for substantial (> $149 million) funding of public health IT infrastructure improvements from HITECH.¹¹ However, this proposal was withdrawn, and ONC redirected most of the moneys previously considered for public health IT infrastructure to other uses. Approximately $30 million of HITECH funding has gone to public health, including $12 million for upgrading immunization registries, $5 million for public health laboratory interoperability, and $5 million to a program led by Surescripts to link 500 hospital laboratories to health departments.¹² But these initiatives do not fund health department integration of the data into their systems. Current funding covers only a small fraction of what CDC had estimated in 2008 was needed to prepare health departments for the challenges of integration with a health care system that relies on electronic health records.¹³

Public health had a second chance to garner appropriated dollars to meet IT infrastructure needs for meaningful use with the passage of the Patient Protection and Affordable Care Act,¹⁴ which authorized spending of up to $700 million on public health infrastructure, including IT infrastructure. Of the authorized moneys, CDC disbursed about $70 million in 2010 for infrastructure improvement grants. Amounts for informatics infrastructure support were relatively small in the initial award. Additional funding for informatics is available to support public health infrastructure for meaningful use through the Electronic Laboratory Capacity grant program ($40 million in 2011¹⁵), although this program is also intended to serve many other public health infrastructure needs.

CRISIS

These choices and priorities have created a serious challenge for public health officials at the local, state, and national levels who try to uphold public health’s end of meaningful use requirements. The HITECH Act could increase availability of data from the clinical care system to public health, but the needs for expansion of the capabilities public health information technology systems are great and the funding to meet these needs is relatively small. Allowing the health care system to evolve without public health integration will have serious consequences for communities.

Furthermore, even if federal funds were available to support public health integration with the clinical care system, public health business processes for IT are inadequate to the task of integrating with a fast-paced interoperable national program. Even if funding for grant programs could be found, the process of meeting evolving requirements of meaningful use is ill suited to traditional CDC-funded grant programs. Such mechanisms would require states not only to compete for eligible funds, but then to design systems and select vendors for ongoing efforts, while also working with local (city and county) health officials who want to maintain autonomy along with interoperability. The result could be unnecessary variability between systems and, perhaps more important, prolonged development processes with uncertain prospects for success. The current approach to public health IT infrastructure development is unlikely to be agile enough to be relevant to the rapidly moving meaningful use timeline. A new approach is needed.

A POSSIBLE SOLUTION

If public health practitioners find the will to work together, they can take advantage of a solution that offers greater capabilities and could even save money. This solution would involve the conversion of public health information management activities, particularly those that interface with the health care system, to cloud computing.

Cloud computing has many variants, but its foundation is a migration of software platforms away from installations on a desktop or server in a local facility to remote hosting, potentially at several sites, linked by the Internet.¹⁶ The National Institute of Standards and Technology defines cloud computing as

a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.^17(p6)

Features of cloud computing include customizability for individual users, fault tolerance and disaster resilience, scalability in performance on demand, and freedom from infrastructure costs for the user. Cloud computing can also integrate technologies that can facilitate sharing of data across users while allowing owners to maintain control of their data. Examples of cloud computing services available today are tools such as Google docs, social networking applications such as Facebook and LinkedIn, and business applications such as Salesforce.

Cloud computing has various service models. The most familiar mode is Software as a Service (SaaS). Users share either a single copy of a software program (Facebook) or the infrastructure that provides access to multiple versions of a software program (e.g., 1 for each organization using the cloud resource). The option that is most relevant to public health, in our opinion, is Platform as a Service (PaaS).¹⁷ PaaS allows users to share a common library of programs, including software-authoring tools and databases. Users own a full version of their environment, in which they can build customized programs as they choose. The operating system and other networking features are clones of each other, minimizing problems with incompatible configurations and reducing the level of expertise needed to achieve interoperability.

Security in a cloud environment depends on existing methods: virtual private networks to encrypt data transmissions, firewalls to keep unauthorized users from accessing systems, and methods of authentication of users, such as smart cards and biometry.¹⁸ Cloud applications can meet Health Insurance Portability and Accountability Act security requirements.¹⁹ Multiple electronic health record vendors have adopted cloud solutions that are in daily use for managing confidential patient data. However, in addition to the usual security measures, cloud systems have to protect against introduction of software that breaks down the software barriers between different users’ programs and data.¹⁸ This is best done in collaboration with cloud clients with open security models and principles. However, it may be difficult for one client to prevent sophisticated attempts at intrusion by another. A cloud service restricted to public health departments would offer reasonable levels of security, at sufficient size to control costs.

Although it is highly desirable for each public health jurisdiction to maintain its autonomy, the idea that each one needs to maintain a separate IT infrastructure to achieve that autonomy is obsolete. It is eminently feasible to offer the software systems needed by public health departments through cloud services. An early example of the use of cloud computing approaches in public health was the National Electronic Disease Surveillance System (NEDSS) Base System Application Service Provider version.²⁰ Under this program, CDC offered states the opportunity to access its NEDSS Base System software using a Web-based SaaS model using what would now be described as a private cloud approach. States could subscribe to the NEDSS Base System software, with each state having its own version that was customized to its needs, with the sharing of infrastructure and support costs for the private data center with CDC.CDC also has recently developed a SaaS public cloud system for its redesign of BioSense to better support meaninful use data requirements.²¹

CLOUD COMPUTING FOR INTEROPERABILITY

In addition to the new problems posed by meaningful use, public health departments continue to face the obstacle of data silos across organizations and programs. Local jurisdictions use system barriers to prevent interference by states, and states do the same to prevent interference by CDC. This practice needs to be replaced by an interoperable system. Of course, such a system requires governance to create a collaborative functional environment. Software systems should allow state and local health departments to work collaboratively. Segregating data by application area makes no sense, as illustrated by the 2 types of surveillance systems most affected by meaningful use: syndromic surveillance and notifiable disease surveillance (the first line of public health defense). Aside from historical precedent, no reason exists to separate the data from these surveillance systems.

A Public Health Cloud Community

Our proposal is intended to (1) create capabilities for public health to meet evolving meaningful use requirements, (2) integrate information supply chains for public health systems, (3) create a free market that will continuously improve public health systems, and (4) enhance efficiency and reduce costs. To achieve these ends, we plan to develop a PaaS community cloud for public health, which would eventually replace the entire suite of CDC-supported applications scattered over multiple computer systems in health departments with a single integrated suite of programs running in a cloud environment. As illustrated in Figure 1, the platform will have 2 components: a set of core services for public health departments and a set of applications that would use the core services to provide public health functions.

FIGURE 1—

Architecture of a Platform as a Service public health cloud platform with core services and interchangeable applications to use those services to provide public health functions.

Note. CDC = Centers for Disease Control and Prevention; PH = public health.

Core services would be developed through an open-source approach that would allow health departments, CDC, and software developers to collaborate on tools. Components would include database software, a master patient index software program (which would provide a uniform patient identifier across applications), interoperability tools (e.g., Direct ²² and PHIN MS²³), tools to support distributed queries of databases across health departments for collaboration during outbreaks (e.g., Public Health Grid^24,25), decision support tools for vaccine forecasting²⁶ and public health alerts²⁷ (e.g., openCDS²⁸), and software development tools to speed development of applications (e.g., CDC’s PHIN Vocabulary Access and Distribution Service²⁹). These services could support a broad range of functions required for meaningful use, including proposed stage 2 and 3 functionality.

Sitting on top of core services would be a set of applications built by either vendors or health departments (Figure 2). These applications would replace existing software systems for public health functions such as the NEDSS Base System or a state immunization registry. Either CDC or a private body, through a process similar to ONC certification of electronic health records,³⁰ would certify each application to ensure that it would perform required public health functions, pose no security threat to other applications or other cloud users, and be interoperable.

FIGURE 2—

Platform as a Service public health cloud with 3 public health departments, each with its own copy of the platform with different applications based on the same core services.

Note. CDC = Centers for Disease Control and Prevention; PH = public health.

The proposed model separates the data models and data storage from the software that implements many of the required functions of public health applications. A kind of application (app) store would be created where public health departments could choose among certified apps for specific departmental functions and even switch apps between vendors without loss of data.³¹ This functionality would enhance competitiveness and innovation in public health software while reducing costs for software development and preventing vendors from locking health departments into their systems. It also would allow vendors to create new types of software programs that combine the functionality of systems that currently segregate data in silos (e.g., merging of syndromic surveillance and notifiable disease investigation applications), promoting innovation.

Public health applications and core services would be made available to health departments from a shared community PaaS cloud. Each department would be able to lease or build customized software solutions. Because solutions would share a common data model and interoperability services, exchange of data between jurisdictions and CDC would be greatly facilitated.

Financing

CDC spends more than $150 million annually on external software systems.³² The majority of that money should be converted over time to state and local grants for purchasing PaaS cloud services, including access to departments′ choice of certified applications. If all externally facing CDC software systems could be converted to PaaS, annual funding might total as much as $0.50 per person in the population served by a health department, divided between state and local jurisdictions, to help support the leasing of applications and access to the PaaS platform.

This funding seems sufficient to create a vibrant market for public health software systems, where vendors would compete to offer improved functionality and high-quality service to state and local health departments. If vendors′ systems proved to be unreliable or otherwise of poor quality, the core service platform would make switching to another vendor easy.

The programs with the greatest need for rapid evolution to keep up with meaningful use regulations are the Immunization Information System (IIS) and the NEDSS and BioSense programs. The NEDSS program supports public health integration with the health care system for notifiable conditions. The BioSense program supports public health integration with the health care system for purposes of syndromic surveillance. Together, appropriations for these 2 programs total about $58 million annually (in the CDC’s 2010 budget³³). Funding for IIS software support is bundled with support for operation of immunization registries and is therefore difficult to assess but probably substantial (in the range of millions of dollars per year).

This core funding would support creation of the platform, organization of an app store for integrated syndromic and notifiable disease surveillance, purchase of immunization registry software, and initial grants for licensing of software. CDC would conduct a competition to certify vendors to compete for eligibility to supply states and local governments with the combined systems. Specifications would encompass meeting meaningful use criteria as well as interoperability between federal, state, and local agencies and with the health care system. Vendors would be certified to provide interoperability across levels of public health. Perhaps most important, vendors would manage connectivity for meaningful use, guarantee that data could be accepted, and adapt and evolve systems as meaningful use requirements evolve.

CONCLUSIONS

In a fully functioning public health cloud community, state and local health departments would have their choice of certified interoperable integrated applications. Each jurisdiction could choose its own vendor and migrate annually, promoting competition and further refinement of software. Applications would be able to exchange both case reports and more complex data with each other. State and local jurisdictions could differ but work together through data exchange in the cloud. The limited number of connections would facilitate data exchange. The vendors of these applications would work to meet meaningful use requirements, and software could rapidly evolve. The pace of connections to the clinical care system would be fast—only a few central connections to vendors supporting public health cloud systems would be required. Connections to CDC would not change greatly. States would notify CDC of cases at appropriate times with transmission of data from their cloud vendor. Integrated support for distributed queries and a common data model would make sharing of data across jurisdictions for surveillance relatively easy.

The advantages of a cloud approach are significant: public health would have a new computing infrastructure to support connections with health care for meaningful use. Remote hosting and shared systems would overcome the problem of insufficient funding and infrastructure for public health systems. Individual jurisdictions could choose their preferred system from a list of certified approved vendors. Systems would be interoperable, facilitating exchange of data between federal, state, and local governments, because a uniform certification process would require this. Vendors of clinical data systems would have a limited number of public health information systems to target and could more readily build systems to interface with public health, lowering costs and speeding adoption. The developers of public health systems would have a reliable market for their products, making investments in innovation possible and advancing the field as a whole.

Although the autonomy of individual jurisdictions has been sacrosanct in public health, extending this principle to the design and implementation of computer systems for public health has created a largely unworkable national system. The present crisis creates an opportunity for change for the better. To reap the rewards of new data sources created by meaningful use regulations, and of new integrated systems that offer greater capabilities, public health needs to embrace change in how it develops and manages its IT systems. In light of the absence of new resources to fund public health IT and the economies of scale created by cloud computing, practitioners should choose to move collectively to a new model of shared infrastructure that can keep pace with the evolution of the health care system s IT; otherwise it will become more isolated from and less relevant to the clinical care system. Free-market competition that creates large-scale shared cloud-computing resources that are certified for both functionality and interoperability is the only realistic route for public health to achieve universal connectivity to the health care system in the meaningful use era.