Health Care
Information Technology Vendors' "Hold Harmless" and “Keep Defects
Secret” Clauses
In the remarkable article Health Care
Information Technology Vendors' "Hold Harmless" Clause - Implications
for Patients and Clinicians, Ross Koppel and David Kreda,
Journal of the American Medical Association, 2009;301(12):1276-1278, we learn
that:
Healthcare information technology (HIT) vendors enjoy a
contractual and legal structure that renders them virtually liability-free—“held
harmless” is the term-of-art—even when their proprietary products may be
implicated in adverse events involving patients. This contractual and legal
device shifts liability and remedial burdens to physicians, nurses,
hospitals, and clinics, even when these HIT users are strictly following
vendor instructions...HIT vendors are not responsible for errors their systems
introduce in patient treatment because physicians, nurses, pharmacists, and
healthcare technicians should be able to identify—and correct—any errors
generated by software faults.
[Yes - we're all knowing magicians with the power
to read minds, infer incorrect lab values via therapeutic touch, and possess
encyclopedic knowledge in our heads at all times. This raises the question: if
we are that omniscient to be able to identify and correct software faults with
100 percent accuracy to avoid patient harm, then why do we need electronic
medical records at all? - ed.]
Also see the
In the new Koppel and Kreda JAMA article we also
learn that:
HIT
implementations are massively complex, and are fraught with delays, errors,
resistance, work process redesign, frustration, and outright failure.
Healthcare facilities cannot predict the myriad scenarios in which
software failures could result in patient harm and liability, and they are not
likely to be knowledgeable a priori about frequent vendor updates.
We additionally learn that:
The significant disparity between buyers and sellers in
knowledge and resources [about healthcare IT problems] is profound and
consequential. Vendors retain company confidential knowledge about designs,
faults, software-operations, and glitches. Their counsel have crafted
contractual terms that absolve them of liability and other punitive
strictures while compelling users’ non-disclosure of their systems’
problematic, or even disastrous, software faults.
[This is simply astonishing. In other words, health IT customers and users have
a gag order imposed on them regarding software faults and defects, while
clinicians -- through their ingenuity, their labor in finding defect
workarounds, and their liability -- serve (as I've written) as captive beta
testers and an insurance company for HIT vendors - ed.]
These observations are nothing short of astonishing. They do help explain,
however, the near silence of hospitals and their executives regarding
healthcare IT faults, an observation I made in this 2006 AMIA presentation
about the scarcity of such information:
Access
Patterns to a Website on Healthcare IT Failure (Abstract
[pdf], Poster
[ppt].)
The Joint Commission also made this observation in their Dec. 2008 Sentinel
Events Alert on Health IT:
There is a dearth of data on the incidence
of adverse events directly caused by HIT overall.
The new JAMA article may also explain why HIT is so often done so poorly as to
present a mission hostile user experience, as I started to write about a
decade ago at my healthcare IT difficulties website here,
as I outlined in an eight part series starting here,
as the American College of Physician Executives noted here,
as the National Research Council noted here
("Current Approaches to US Healthcare IT are Insufficient"), and as
many others noted as well:
Healthcare
IT News (3/10, Merrill) reported, a survey conducted by the American
Without accountability, a manufacturer is unmotivated to produce quality
products at the expense of profits. They become complacent and lazy. This is an
excellent reason why major HIT applications are as abhorrent as they are and
violate so many fundamental principles of human computer interaction and
resilience engineering.
It can also explain why talent management within the vendors is biased against
hiring medical informatics experts, who would resist intellectual laziness of
their non-informatics profit oriented (and unaccountable) counterparts.
Koppel and Kreda note that such stipulations defeat
patient safety efforts and are contrary to the principles of evidence based
medicine. I can add that such stipulations are contrary to the principles of good
engineering.
These stipulations further instantiate my observation that health IT lacks
the rigor of medical science itself, its major Achilles heel. This is one
reason why I believe a national HIT initiative at this point in time is going
to be, as
in the UK, nothing short of an expensive debacle.
The existence of "hold harmless" clauses and gag orders raises many
questions:
- Clinical supervisors of other physicians are indeed
practicing medicine. Are Health IT vendors in fact practicing medicine
by cybernetic proxy via these IT systems?
- Aren't the vendors' own claims of revolutionary
healthcare quality improvements mediated via EMR's,
alerts and reminders, clinical decision support, etc., malfunctions of
which physicians may be held liable, prima facie evidence that the
vendors are in fact practicing medicine by proxy?
- Should not these purveyors of cybernetic (i.e.,
virtual) medical devices be held accountable for their products, as
in the pharmaceutical and the non-cybernetic (i.e., physical) medical
device industries?
- How did such a situation regarding critical healthcare
devices arise?
- In what other healthcare or other technology intensive
industries, if any, do similar conditions exist, and what are the
repercussions?
- How long has this situation existed?
- Why is it tolerated by clinicians?
- Why is it tolerated by clinical leaders?
- Why is it tolerated by medical professional societies,
such as the AMA, the ACPE, etc., supposedly representing their members'
interests?
- Why is it tolerated by hospitals and their executive
leadership and boards of directors?
- Why is it tolerated by IS departments in hospitals?
- Why is it tolerated by hospital general counsel?
- Are there possible civil tort/RICO
(racketeering)/criminal implications regarding patients injured by
defective health IT where defects were known but not disclosed?
- Is not such a protective arrangement prima facie
evidence that this technology is indeed experimental, with patients and
clinicians as unconsented experimental subjects?
- Why is it tolerated by our government?
Regarding the last point, the Obama administration
has promised an atmosphere of national accountability and responsibility. Why,
then, has it simultaneously employed the coercive force of government (payment
penalties for HIT non adopters after the absurdly short period of five years
from now, 2014) to push an exploratory medical device from an unaccountable
industry of unproven ROI at a cost of tens of billions of dollars on to the
medical profession? This reality raises another question as I suggested in my WSJ
Letter to the Editor of February 18, 2009. I wrote:
Dear
Wall Street Journal:
You
observe that the true political goal is socialized medicine facilitated by
health care information technology. You note that the public is being deceived,
as the rules behind this takeover were stealthily inserted in the stimulus
bill.
I
have a different view on who is deceiving whom. In fact, it is the government
that has been deceived by the HIT industry and its pundits. Stated directly,
the administration is deluded about the true difficulty of making large-scale
health IT work. The beneficiaries will largely be the IT industry and IT
management consultants.
In other
words, was the administration misled by the health IT industry? I believe it
might have been.
As an example, Mr. Obama's healthcare IT policy
campaign adviser per
the WSJ Glen Tullman, CEO of HIT vendor AllScripts and Board member of the industry-created
government contractor CCHIT ("Certification Commission for Healthcare
IT"), probably didn't tell Mr. Obama his company was selling goods that did not function
properly. (Here is a link to my organization's Civil
Complaint against AllScripts, PDF). We apparently
cannot know how many other organizations had their own complaints that might
not have made it into litigation, due to the aforementioned gag orders.
(Ironically, I found out about the lawsuit at my own organization only through
an anonymous comment at the HIT gossip site HISTalk.)
Incidentally, by matter of pure speculation, I was not permitted involvement in
that implementation despite having been a pioneering CMIO at a larger
healthcare system years prior and the only formally educated medical informaticist at my organization. My writings on health IT
dysfunction were well known to the IT staff and likely the vendor after a short
web search; it would have been in the vendors' interests to keep me away from
sales and implementation of known deficient health IT. Again, this is simply
speculation.
On the other hand, I am aware of major healthcare organizations with
"portfolios" of hundreds or thousands of issues and defects awaiting
remediation, and CMIO's struggling against cavalier
bureaucracies who want the doctors even in critical care areas to live with the
problems, and vendors who are not in a hurry to fix their products.
Some of the problems rise to the level of critical with regard to patient
safety. Under contract, the problems cannot be disclosed to the public,
to patients whose care might fall under the aegis of these systems, or to other
healthcare organizations seeking the same systems. I hope to be a plaintiff's
witness when the inevitable lawsuits for patient injury place such capricious
vendor, hospital and IT leadership on the witness stand.
Finally, in fairness the JAMA article discusses issues beyond the vendors'
control such as misuse or poor training done by the host organization using the
IT.
Possible remedies to the situation of unaccountability for the outcomes of HIT misdesign, malfunction and other defects are outlined in
the article. See it or the press release at the above links if you lack JAMA
access.
As I've written numerous times on this site, due to the implications and
especially now due to the revelation that the scarcity of adverse events
information related to HIT is probably by design, I favor stringent health
IT regulation as
in pharmaceutical IT.
Whatever happens, however, I know this. For the sake of patient safety:
These inexcusable practices must end.
Regarding
healthcare IT "Hold Harmless" and Defects Gag Clauses, I also
question whether hospital executives violated their fiduciary responsibilities
by signing such contracts, and violated Joint Commission standards of hospital
leadership conduct as well.
Fiduciary (fidOO'shēe"rē),
in law, a person who is obliged to discharge faithfully a responsibility of
trust toward another. Among the common fiduciary relationships are
guardian to ward, parent to child, lawyer to client, corporate director to
corporation, trustee to trust, and business partner to business partner. In
discharging a trust, the fiduciary must be absolutely open and fair.
Certain business methods that would be acceptable between independent parties
dealing with one another “at arm's length” may expose a fiduciary to liability
for having abused a position of trust.
Hospital management conduct is not bound by traditional business law only, just
as physicians and other clinicians hold additional obligations. In both cases,
obligations go beyond that of, say, a manager or worker at a McDonald's or a
Wal-Mart.
I earlier in this essay expressed great concern about the remarkable
revelations in Koppel and Kreda's expose of arguably
unethical and clearly inexcusable contracting practices by healthcare IT
producers and vendors.
The vendors have declared themselves off limits from liability even if patients
die as a result of software defects and malfunctions, pushing that liability
onto clinicians. Vendors have simultaneously declared themselves the Ministry
of Information, Soviet style, on such defects.
I also expressed my concern that the contractual suppression of information
dissemination on health IT problems and defects may be one reason websites on
health IT difficulties, such as this one started in 1998 (in fact cited by
Koppel and Kreda) remain uncommon on the Web. This is
despite my documentation of continued, ongoing, world wide interest in
this topic (see my 2006 AMIA abstract on this issue here,
PDF, and poster here,
PPT).
It is not just the vendors who may be acting against the best interests of
medical science and patient safety, however.
It also seems to me that hospital executives, boards and counsel have fiduciary
responsibilities, as well as obligations under principles of due diligence,
Joint Commission and other regulatory guidelines, etc. to protect not just
patients from defective technologies but also to protect their staffs from
unfair risks and legal liabilities. I note that these health IT contracts
have apparently been signed willingly by hospital executives, against the
best interests of patients and medical staffs. Nobody is holding a gun to
their heads, and nobody is forbidding negotiation of terms.
As a former CMIO/Director of Informatics I would never have signed such a
contract. Period. (Of course, CMIO's and Directors of
Informatics don't generally sign or even see health IT contracts, as they are Chiefs
and Directors of Nothing.)
Have hospital executives, boards of directors and counsel been violating their
responsibilities and obligations every time they've signed a healthcare IT
"hold vendors harmless, it's all on your docs" and "shhhh! keep the defects secret" contract? Have they
abused their positions of trust?
NIH research leaders and grant reviewers, as an example, consider seriously any
problems with research that might place not just research subjects but also investigators
at risk, medically, legally and otherwise. I perform this function on NIH study
section panels.
Let's look at the Joint Commission Hospital
Accreditation Program Leadership
Chapter, and its standards for hospital leadership (link,
PDF):
Leadership
LD.01.03.01
Standard LD.01.03.01
The governing body is ultimately accountable for the safety and quality of
care, treatment, and services.
Rationale for LD.01.03.01
The governing body’s ultimate responsibility for safety and quality derives
from their legal responsibility and operational authority for [organization]
performance. In this context, the governing body provides for internal
structures and resources, including staff, that support safety and quality.
The governing body has a legal responsibility for safety and quality, not just
a moral obligation. One of the "internal structures" is healthcare IT
that is safe and effective and that does not expose patients or staff to undue
risks.
How does signing "hold harmless" and "defects gag order"
clauses with an HIT vendor serve such a purpose, exactly?
Hospital executives know, should know, or should have known that such
provisions would remove incentives for health IT vendors to produce the best
products and to correct deficiencies rapidly, thus increasing risk to patients
and clinicians.
Elements of Performance for LD.01.03.01
5. The governing body provides for the resources needed to maintain safe,
quality care, treatment, and services.
One of those resources is health IT.
Standard LD.02.01.01
The mission,
vision, and goals of the [organization] support the safety and quality of care,
treatment, and services.
Rationale for LD.02.01.01
The primary responsibility of leaders is to provide for the safety and quality
of care, treatment, and services. The purpose of the [organization]’s mission,
vision, and goals, is to define how the [organization] will achieve safety and
quality. The leaders are more likely to be aligned with the mission, vision,
and goals when they create them together. The common purpose of the
[organization] is most likely achieved when it is understood by all who work in
or are served by the [organization].
How is a contract with an HIT vendor that calls for hiding defects in health IT
and exposing staff to liability for defects in same serving the above purposes?
Standard LD.02.03.01
The governing body, senior managers and leaders of the organized medical staff
regularly communicate with each other on issues of safety and quality.
Does that include communication on health IT defects? Can a medical staff
member ask to see a database of such defects when the hospital has signed a
nondisclosure of defects agreement with an HIT vendor?
Rationale for LD.02.03.01
Leaders, who provide for safety and quality, must communicate with each other
on matters affecting the [organization] and those it serves.
I ask the same question as above.
Standard LD.03.01.01
Leaders create and maintain a culture of safety and quality throughout the
[organization].
Safety for whom, exactly? Patients, or patients and staff?
How is exposing professional staff to undeserved liability from defective
health IT serving the creation of a culture of safety and quality for them? How
is suppressing information on health IT defects and problems helping patient
safety and care quality?
How is lack of seeking informed consent on health IT use from patients
whose care is mediated by health IT devices with known but undisclosable defects creating a culture of
quality?
How is hiding such defects creating a culture of quality in the community's
other hospitals, that may be considering purchase of the very same health IT?
Standard LD.03.04.01
The [organization] communicates information
related to safety and quality to those who need it, including staff, licensed independent practitioners, [patient]s, families, and external interested parties.
Rationale for LD.03.04.01
Effective communication is essential among individuals and groups within the
[organization], and between the [organization]
and external parties. Poor communication often contributes to
adverse events and can compromise safety and quality of care, treatment,
and services. Effective communication is timely, accurate, and usable by the
audience.
Are physicians and nurses explicitly informed by administration that clinicians
are liable for bad outcomes due to software problems? Are they informed of the
gag clause? Are patients informed of unremediated
health IT defects existing at time of service?
This standard seems a veritable smoking gun regarding breach of fiduciary
responsibility and Joint Commission obligations when hospital leadership signs
agreements specifically excluding the sharing information about health IT
defects and complaints. It is already known that hospitals maintain lists of
health IT defects, some in the thousands of items. A number of the defects
rise to the level of creating considerable risk to patients, and nobody is in a
hurry to remediate them. (See my proposed although somewhat tongue in cheek
"HIT Informed Consent" that describes some of these known
defect categories here).
Standard LD.04.04.03
New or modified services or processes are well-designed.
... 3. The hospital's design of new or modified services or processes
incorporates: Information about potential risks to patients.
4. The hospital's design of new or modified services or processes incorporates:
Evidence-based information in the decision-making process. Note: For example,
evidence-based information could include practice guidelines, successful
practices, information from current literature, and clinical standards.
How does the contractual inability to communicate about health IT defects,
which its executives willingly sign, serve this purpose?
Standard LD.04.04.05
The [organization] has an organization-wide, integrated [patient] safety
program.
... 12. The hospital disseminates lessons learned from root cause
analyses, system or process failures, and the results of proactive risk
assessments to all staff who provide services for the specific
situation.
Disseminates lessons learned, except when the HIT contract they've signed with
a vendor forbids it, that is.
The practices of the health IT industry, and the dealings of the hospital
leadership with that industry, may in fact be a scandal of national (or
international) proportions.
I urge physicians and concerned others reading this to read the Univ. of PA
press release "Why Are Healthcare Information Manufacturers Free of All
Liability When Their Products Can Result in Medical Errors?" here,
obtain the JAMA article by Koppel and Kreda, and call
their congressional and other representatives to have these self-serving
industry practices that ignore protection of patients and practitioners from
undue jeopardy stopped.