The Parallels Between Health Care and Financial Dysfunction: Leadership's Impunity as Demonstrated by the Citigroup Case

For years, we have noted the parade of legal settlements made by large health care organizations.  The parade is notable on one hand because it illustrates how often some of our best known health care corporations and institutions behave badly. 

Impunity for Health Care Leaders

It is notable on the other hand because it illustrates how the leaders of these organizations have virtual impunity.  In very few cases has any person who authorized, directed, or implemented bad behavior faced any negative consequences.  The executives of these organizations often have gotten to continue making millions of dollars while the financial costs of settlements are borne by the company as a whole, and hence by all the employees, no matter how poorly paid or uninvolved, and all stockholders, no matter how powerless they were to prevent the bad behavior.

The legal settlements that now seem to be the only effort made by the government to ensure fairness, honesty, and a level playing field in the health care "industry" seem to have no deterrent effect.  Some of the most famous health care companies have been subject to successive settlements, each of which failed to deter the next bout of bad behavior.  For example, we just posted about NINE separate settlements made by global pharmaceutical giant Pfizer Inc from 2002 to 2011, the largest for $2.3 billion.  Yet a succession of Pfizer CEOs made tens of millions a year, and left with golden parachutes (see post here).  Johnson and Johnson subsidiaries have settled with corporate guilty pleas to several misdemeanors, while the company CEO made tens of millions a year and served as an adviser to the President.  (See summary of offenses here, CEO's compensation here, and his White House role here.) 

With the rise of the "Occupy Wall Street" movement and its spin-offs, and the resurgence of the global financial crisis now threatening the Euro-zone in particular, the discussion of how the world's finance system has become fiercely dysfunctional that should have occurred after the crisis began in 2008 is now starting.  That discussion has now focused on the relative impunity of the leadership of finance firms, a striking parallel to what has gone on in health care.

The Citigroup Settlement

The case that has created headlines is that of Citigroup, and a new settlement of allegations brought against it by the US Securities and Exchange Commission (SEC).  A commentary by Jonathan Weil in Bloomberg explained it thus:

Five times since 2003 the Securities and Exchange Commission has accused Citigroup Inc’s main broker-dealer subsidiary of securities fraud. On each occasion the company’s SEC settlements have followed a familiar pattern.

Citigroup neither admitted nor denied the SEC’s claims. And the company consented to the entry of either a court injunction or an SEC order barring it from committing the same types of violations again. Those 'obey-the-law' directives haven’t meant much. The SEC keeps accusing Citigroup of breaking the same laws over and over, without ever attempting to enforce the prior orders. The SEC’s most recent complaint against Citigroup, filed last month, is no different.

As in most of the health care cases, Citigroup has been subject to multiple legal settlements, each of which apparently failed to deter the next bit of bad behavior. Also, while the SEC made the company promise in particular settlements not to misbehave again, the SEC never held the company accountable for these promises.

Other features of the Citigroup settlement paralleled many of those in health care. The company was never made to admit bad behavior. No top executive ever paid any penalty.

However,unlike many health care cases, the Citigroup case produced an uproar, partially because the presiding judge refused to accept the settlement without questions.

A Judge Questions the Settlement

Instead, the judge had caustic questions for both the SEC and Citigroup. For example, as reported by the Washington Post,

A federal judge Wednesday challenged the SEC’s plan to settle a fraud case against Citigroup for $285 million, saying that the deal would recoup only a fraction of investors’ losses and would leave the firm free to proclaim its innocence in private lawsuits over the remaining damages.

The judge used the Citigroup case to mock the SEC’s traditional way of doing business — allowing defendants to settle without admitting or denying wrongdoing.

The unproven allegations, U.S. District Court Judge Jed S. Rakoff said, 'are no better than rumor or gossip.'


'Does not the SEC of all agencies have an interest in establishing what the truth is?' Rakoff asked.

Also, he mocked the SEC practice of requiring promises of good behavior, that go unenforced,

SEC settlements routinely include court orders prohibiting defendants from committing similar violations in the future and exposing them to potentially severe consequences if they do. However, the agency has refrained from enforcing those injunctions against repeat offenders.

Citigroup was subject to two injunctions that predated the current case, SEC chief litigation counsel Matthew T. Martens said.

Rakoff suggested that the injunctions are 'just for show.'

The SEC lawyer said the agency takes past offenses into account when determining an appropriate penalty. Other SEC officials said after the hearing that past injunctions can be enforced only when the SEC catches a defendant in an ongoing violation.

The proposed settlement also calls for Citigroup to take remedial steps to reduce the risk of future violations; Rakoff asked if those were merely 'window dressing.'

This unusual hearing was covered by the Wall Street Journal, the New York Times, Bloomberg, and other major media outlets.

Finance's Own Parade of Settlements

Meanwhile, the NY Times did some in-depth reporting to show that the Citigroup case was hardly a fluke. There has been a parade of legal settlements of bad behavior by finance firms paralleling the parade we have discussed by health care organizations, although the former occurred without there being a "Finance Renewal" blog to comment on them. As written by Edward Wyatt,

Citigroup is far from the only such repeat offender — in the eyes of the S.E.C. — on Wall Street. Nearly all of the biggest financial companies, Goldman Sachs, Morgan Stanley, JPMorgan Chase and Bank of America among them, have settled fraud cases by promising the S.E.C. that they would never again violate an antifraud law, only to do it again in another case a few years later.

A New York Times analysis of enforcement actions during the last 15 years found at least 51 cases in which 19 Wall Street firms had broken antifraud laws they had agreed never to breach.

In particular,

Of the 19 companies that the Times found to be repeat offenders over the last 15 years, 16 declined to comment. They read like a Wall Street who’s who: American International Group, Ameriprise, Bank of America, Bear Stearns, Columbia Management, Deutsche Asset Management, Credit Suisse, Goldman Sachs, JPMorgan Chase, Merrill Lynch, Morgan Stanley, Putnam Investments, Raymond James, RBC Dain Rauscher, UBS and Wells Fargo/Wachovia.

The NY Times article also found some experts willing to criticize the current effeteness of government regulation and law enforcement:

Senator Carl Levin, a Michigan Democrat who is chairman of the Senate permanent subcommittee on investigations and has led several inquiries into Wall Street, said the S.E.C.’s method of settling fraud cases, is 'a symbol of weak enforcement. It doesn’t do much in the way of deterrence, and it doesn’t do much in the way of punishment, I don’t think.'

Barbara Roper, director of investor protection for the Consumer Federation of America, said, 'You can look at the record and see that it clearly suggests this is not deterring repeat offenses. You have to at least raise the question if other alternatives might be more effective.'

Also,

some experts view many settlements as essentially meaningless, particularly since they usually do not require a company to admit to the accusations leveled by the S.E.C. Nearly every settlement allows a company to 'neither admit nor deny' the accusations — even when the company has admitted to the same charges in a related case brought by the Justice Department....

Summary

As we learn more about what has gone wrong with our political economy, the parallels with what has gone wrong with health care become more obvious. Of course, health care must operate within a larger environment, and there has been increasing overlap between the leadership of finance and of health care.

As the economy continues to sag, with rising unemployment and under-employment, increasing foreclosure, homelessness and poverty, and the decreasing likelihood of an even minimally comfortable retirement for many, it appears peoples' minds are increasingly focused on what has gone wrong, and particularly how ill-informed, incompetent, self-interested, conflicted and corrupt leadership of financial firms has lead to this severe economic dysfunction.

I also hope that as the health care crisis continues to worsen, with rising costs, decreasing access, and degrading quality, peoples' minds will also increasingly focused on what has gone wrong, and particularly, as we have been saying for nearly seven years, how ill-informed, incompetent, self-interested, conflicted and even corrupt leadership of health care organizations has lead to this severe health care dysfunction.

Maybe someone will now take seriously our calls for... true health care reform that requires competent, ethical leadership that upholds health care's core values within a governance structure of accountability, integrity, transparency, and honesty. Tackling the deep problems in health care will require tackling the deeper problems in the global political economy which helped to generate them.

EHRevent.org Leadership: "Heck, getting out of bed in the morning is dangerous- it just beats the alternative"

I have posted about the organization EHRevent.org on numerous occasions. I expressed concerns that this organization's representation as an alternative aggregator of health IT difficulty cases, compared to established organizations and resources such as FDA's Medwatch and MAUDE database, was probably not a good idea:

November 15, 2010: EHRevent.org: Web Site to Collect EHR Safety Reports

November 16, 2010: EHRevent: survey amateurism, bias, or something else?

November 17, 2010: Some answers about new site "EHRevent.org" for health IT and drug adverse event reporting

November 22, 2010: EHRevent.org CEO Edward Fotsch MD: The Real Challenge with EHRs is -- User Error?

July 24, 2011: EHRevent.org and "The National Database of EHR Errors Being Called For" - Where's the Beef?

The Nov. 22, 2010 post "EHRevent.org CEO Edward Fotsch MD: The Real Challenge with EHRs is -- User Error? " is particularly relevant to this one.

I saw the following remarkable comment by EHRevent.org CEO Edward Fotsch MD on the HISTalk blog. It was in a comment section regarding the new Institute of Medicine report "Health IT and Patient Safety: Building Safer Systems for Better Care" on health IT risks (my initial post on that topic is here):

ed fotsch Says:

Re: the IOM/ONC report it seems to me that the IOM started with the wrong question. Question #1 posed should have been- ‘Are Health IT/EHR systems, when implemented appropriately, safer and better than the current paper system in most hospitals and MD offices; as opposed to the question that apparently was posed: ‘are EHRs safe.’

Heck, getting out of bed in the morning is dangerous- it just beats the alternative. Once question #1 HAD been answered, question #2 could have been tee’d up- ‘How can we make EHRs better?” But that ship has sailed and now they and we in Tidy-Bowl mode. The wrong question was asked so we’re dealing with what may be the right answer to the wrong question. And it will be hard to get the toothpaste back in the tube, worms back in the can, etc. on this one from an ONC/IOM standpoint- and yes the press will have a field day, those running for office will have more fodder and Republicans (no issue per se with Republicans BTW) who are pushing for less (not more) government regulation will have a field day with this set of recommendations.

November 8th, 2011 at 10:53 pm

While I do not know Dr. Fotsch, my questions about this comment are as follows:

• Are its viewpoints entirely objective with regard to health IT?
  


• Is it consistent with a physician-executive who thinks critically about risk, and knows the literature (such as here), or with someone who leans toward technologically deterministic views about healthcare IT?


• Is it a reasonable view from the CEO of an organization seeking a position of enormous public responsibility as the "central place for reporting adverse EHR events or near misses or potential problems or issues with electronic health records", as described of EHRevent.org in the aforementioned Nov, 22, 2010 post?


• It is an appropriate comment for someone holding such a position?

These questions repeat some of the concerns as expressed in my previous posts.

I responded as follows at HIStalk in the same comment thread. Emphases in the original:

To Dr. Fotcsh:

My opinion differs. I believe the IOM asked the correct questions.

The answer to your proposed question “‘Are Health IT/EHR systems, when implemented appropriately, safer and better than the current paper system in most hospitals and MD offices” is – nobody really knows. The IOM explicitly acknowledges this:

----------------------------------
… “For example, the number of patients who receive the correct medication in hospitals increases when these hospitals implement well-planned, robust computerized prescribing mechanisms and use barcoding systems. But even in these instances, the ability to generalize the results across the health care system may be limited. For other products— including electronic health records, which are being employed with more and more frequency— some studies find improvements in patient safety, while other studies find no effect.

More worrisome, some case reports suggest that poorly designed health IT can create new hazards in the already complex delivery of care. Although the magnitude of the risk associated with health IT is not known, some examples illustrate the concerns. Dosing errors, failure to detect life-threatening illnesses, and delaying treatment due to poor human–computer interactions or loss of data have led to serious injury and death.”
----------------------------------

The technology is experimental.

In my opinion, that invokes the medical adage “First, do no harm.” There exist protocols for human subjects experimentation. The health IT industry has exempted itself from those protocols.

My overall thoughts on the IOM report are at http://hcrenewal.blogspot.com/2011/11/iom-report-on-health-it-safety-nix-fda.html

-- SS

CEOs First to Benefit from For-Profit Takeovers of Non-Profit Hospitals

Last year, we noted concerns about the againy fashionable practice of for-profit corporations taking over previously not-for-profit hospitals and hospital systems. Two examples we cited were the planned acquisitions of Detroit Medical Center (DMC) by Vanguard Health, which was owned by the Blackstone Group, and of Caritas Christi Health Care by Cerberus Capital Management.

At the time, we noted, "for-profit leaders tend to expect even larger compensation than not for-profit CEOs. Their decisions tend to be driven by their short-term compensation, rather than the good of the organization." So we asked, "will making a not-for-profit health care organization into a for-profit corporation really lead to more efficiency and lower costs?" In a later post, we worried about "ever-increasing executive compensation while making money becomes the overwhelming priority for the organization, completely eclipsing such quaint concepts as quality of care, reasonable costs, or adequate access."

About one and one-half years later, we have some follow-up from the media about the results of these deals, especially as they pertain to executive compensation.

Detroit Medical Center, Vanguard Health Systems, Blackstone Group

Our post last year quoted then Mike Duggan, then CEO of DMC, that "We were being choked to death by the nonprofit business model."

This month, the Detroit Free Press reported,

Detroit Medical Center CEO Mike Duggan's total compensation this year from Vanguard Health Systems, the private health care company that bought the DMC, is $2.41 million in pay, bonuses and several years of stock options, up from the $1.98 million in 2009 when DMC was a nonprofit, according to public documents.

About $1.3 million of Duggan's total compensation is in stock options that he would start receiving next year through 2019, the documents show.

Note also that,

The package also calls for Duggan to get $1 million if he's fired or $5 million if Vanguard sells the DMC to another company -- fairly common conditions in contracts, experts said.

Duggan's new compensation package puts him in the top tier of local health care executives.

It seems like Mr Duggan is no longer being "choked to death."

Cursory review of the media reveals that since the acquisition, DMC has some major construction projects planned. However, I saw nothing yet about whether the acquisition has decreased costs, increased access, or improved the quality of care.

I should note that Mr Duggan appears just a bit uncomfortable with his generous compensation in this era of anger about the power of the one percent:

Duggan said he agreed with Occupy Wall Street protesters who point to the growing gap between the poor and rich: "I do believe people should be able to work hard and earn a lot of money. (But) the gap between the top and the bottom is not fair in this country," he said. "I don't have the ability to fix the world, but my wife and I are making a gesture that's appropriate for us. If people say we get paid a lot of money, I think they are right. I'm trying to do something to share some of the benefit."

The gesture mentioned above would be

he and his wife plan to create a foundation next year to hold the stock earnings, after taxes, for scholarships for children of DMC employees.

Whether it is carried out, of course, remains to be seen.

Caritas Christi Health Care, Steward Health Care, Cerberus Capital Management

The initial story about the proposed take-over in the Boston Globe noted that one rationale was how:

Caritas has long struggled financially, but since coming to the chain two years ago, [CEO Dr Ralph] de la Torre has worked to strengthen its financial position by aggressively cutting costs and boosting revenue from medical care. It posted operating income of $30.5 million for the fiscal year ending last Sept. 30 compared with a $20.5 million loss the prior year.

The aim would be:

to provide quality community-based care at a reasonable cost.

Some specific goals of the proposed take-over would be

Under the agreement, Cerberus will invest $430 million to $450 million immediately to pay off Caritas debt, finance renovation projects, and provide working capital, while also assuming its pension liability.

To pursue all this,

While de la Torre and other senior executives will retain their current salaries and benefits, they would be eligible for additional compensation from Cerberus based on the financial performance of the hospitals, Caritas officials said. They said the details of those financial incentives have yet to be worked out.

Last month, a Boston Globe article provided a little more clarity about these compensation arrangements:

Ralph de la Torre, former chief executive of Boston-based Caritas Christi Health Care, drew a total pay package of $2.2 million from the Catholic hospital system in 2009, making him the best-compensated hospital executive in Boston that year, according to documents filed with the state attorney general’s office.

The package, which included base salary, a performance bonus, and incentive compensation linked to improving finances at the hospital chain, marked an increase from the $1.2 million de la Torre earned from Caritas in 2008.

Note that after the take-over, the Caritas Christi system was renamed as Steward Health Care.

So prior to the actual take-over by Cerberus, but presumably while initial negotiations about it were going on, Dr de la Torre had already become the best paid hospital CEO in Boston.

Becker's Hospital Review noted that De la Torre's 2010 total compensation was exactly $2,270,076. The Caritas Christi 2010 IRS form 990 also listed 19 executives who received more than $400,000. Of these, 11 received more than $600,000. Meanwhile, according to this form, the system's losses were accelerating, going from -$6,583,625 in 2008 to -$23,858,733 in 2009.

So, it seems that Dr De la Torre became significantly richer in anticipation of the proposed (and now accomplished) take-over of Caritas Christi by Cerberus Capital Management, even though his hospital system's hemorrhaging of money was increasing at that time.

Again, I was not able to find any clear evidence whether the take-over had decreased costs, increased access, or improved quality of care. I did find one report suggesting that some Steward Health nurses did not think that it had stabilized their pensions as promised. According to the Boston Business Journal,

Nurses and other health care workers from several of the hospitals owned by the for-profit Steward Health Care, plan to protest outside the company's Boston headquarters today at 1:30. They include nurses from St. Elizabeth’s Medical Center, Brighton, Norwood Hospital, Good Samaritan Hospital in Brockton, Morton Hospital in Taunton, Quincy Medical Center Carney Hospital in Dorchester, Holy Family Hospital in Methuen and Merrimack Valley Hospital in Haverhill.

Nurses argue that Steward, owned by New York private equity firm Cerberus Capital Management, has not honored agreements to the workers, including a commitment to create a defined-benefit pension plan. They also say that Steward has threatened to eliminate essential services in retaliation for the nurses demand for the pension plan.

Summary

Two acquisitions by private equity firms of non-profit hospital systems have resulted in increased compensation for the systems' CEOs, and perhaps other top executives.  These increases predated any recognizable improvements in quality or access, or decreases in health care costs.

Acquisitions of non-profit hospitals and hospital systems by for-profit entities, including private equity firms, is one of the newly fashionable ways our health care leaders have promised to improve care, increase access and control costs. The evidence about whether this tactic accomplishes these aims is not yet in. However, it appears that this tactic may be another, and a rapid way for top health care executives to increase their personal incomes.

Health care professionals, patients, and the public at large ought to be increasingly skeptical of the latest fashions in health care management, especially those that have potential to further enrich managers.

As we recently noted, more people in the US and other countries are frustrated that their attempts to work hard and follow the rules of the economic system yield less rewards. Meanwhile, it appears that well-connected insiders are increasingly gaming the system for their personal profit. We have noted how health care executives' compensation seems independent of their talent, skill, or innovation, much less their ability to uphold the values and fulfill the mission of their organizations. Their compensation often seems to rise inexorably, regardless even of the financial status of their organizations.

Now it appears that inflating compensation in anticipation of or due to a merger or acquisition is another mechanism by which insider executives gain, while others in health care lose.

Once more with feeling .... true health care reform requires competent, ethical leadership that upholds health care's core values within a governance structure of accountability, integrity, transparency, and honesty. Tackling the deep problems in health care will require tackling the deeper problems in the global political economy which helped to generate them.

IOM Report - "Health IT and Patient Safety: Building Safer Systems for Better Care" - Nix the FDA; Create a New Toothless Agency

[Authors' note: This major part of this post was written before I had the actual IOM report itself. Having now read that report, available here in PDF, my opinions are unchanged.]

The Center for Public Integrity has published a story ahead of the Thursday release of the Institute of Medicine's report on health IT safety. This was a panel, by the way, that rejected my testifying, live, about my own relative's IT- related harm, despite my Medical Informatics credentials and explicit requests [see note below].

The IOM report apparently recommends that an extraordinary special accommodation be afforded to the healthcare IT industry regarding regulation of health IT software devices.

Excerpts from the Center for Public Integrity's article:

Panel recommends new agency to investigate safety of health information technology

Health information technology has been touted as crucial to better health care, but a new report says an entirely new regulatory agency is needed to oversee this largely unregulated sector, which can also injure or kill patients if it’s not operating properly.

We would never have known that if not for the efforts of a small group of specialists with a conscience writing on this issue over the past decade; the industry long emphasized only the beneficence of the technology.

In pushing for a new oversight body, the respected Institute of Medicine, an independent research and advisory organization, is explicitly advising that the Food and Drug Administration (FDA) not be tasked with the job — a recommendation that is bound to be controversial. [Indeed - ed.]
The eagerly anticipated report, titled “Health IT and Patient Safety: Building Safer Systems for Better Care,” will be publicly released Thursday. A copy was obtained by iWatch News. The study details nine other recommendations for how to ensure patient safety when doctors and other health care providers use health information technology, or health IT. The findings from the report were presented October 28 to the Department of Health and Human Services (HHS) and its agencies.

I do not consider the IOM's rationale for excluding the FDA to be reasonable...more below.

... the push [by the Administration] is occurring so far without any agency really ‘watch dogging’ the safety of health IT — the software, hardware and systems that record and manage patients’ health information. These expensive devices by and large have not gone through any regulatory checks for safety in the way that food, drugs and other medical technology must; most of that oversight is handled by the FDA. But at the moment, no one is required to report instances of harm caused by health information devices and no government agency currently monitors their safety.

This is a scandal of major proportions, considering the government has taken the approach "ready, shoot, aim" in putting in place penalties for non-adopters on a fantastically rushed timeline, via the HITECH Act within ARRA, while ignoring the risks.

“With all of that money, marketing and public outreach, most simply affirm the value of health IT as an article of faith, rather than investigate it via careful evaluation,” said Ross Koppel, adjunct professor of sociology at the University of Pennsylvania and its School of Medicine, and investigator for RAND Corporation. He is listed as one of the reviewers of the report.

"Faith" (e.g., irrational exuberance) in a technology has no place in science or medicine.

Addendum:  from the report itself:

... While some studies suggest improvements in patient safety can be made, others have found no effect. Instances of health IT–associated harm have been reported. However, little published evidence could be found quantifying the magnitude of the risk.

Several reasons health IT–related safety data are lacking include the absence of measures and a central repository (or linkages among decentralized repositories) to collect, analyze, and act on information related to safety of this technology. Another impediment to gathering safety data is contractual barriers (e.g., nondisclosure, confidentiality clauses) that can prevent users from sharing information about health IT–related adverse events. These barriers limit users’ abilities to share knowledge of risk-prone user interfaces, for instance through screenshots and descriptions of potentially unsafe processes. In addition, some vendors include language in their sales contracts and escape responsibility for errors or defects in their software (i.e., “hold harmless clauses”). The committee believes these types of contractual restrictions limit transparency, which significantly contributes to the gaps in knowledge of health IT–related patient safety risks. These barriers to generating evidence pose unacceptable risks to safety.

[IOM (Institute of Medicine). 2012. Health IT and Patient Safety: Building Safer Systems for Better Care (PDF). Washington, DC: The National Academies Press, pg. S-2.]

In other words, nobody has any real idea of the magnitude of harms, which also implies nobody knows if the magnitude of harms exceeds the magnitude of benefits.  National rollout under these conditions is a horribly unethical situation on first principles.

Though a variety of studies have concluded that the use of health IT may improve patient safety, mistakes made in the systems or difficulty using the technology can lead to serious injury or death, according to the report.

Other studies actually show little or no benefit or cost savings. See this reading list for examples. So, it has been article of faith that the technology in its present form is of benefit, and is not a risk.

An allergy might be omitted from a computer record, for example, or an incorrect medication dosage might be recorded. In Rhode Island, a Lifespan computer glitch [5] caused about 2,000 patients to receive the wrong types of medications. In another instance [6] in March 2009, an unattended patient suffered multiple seizures for hours after a computer failed to alert doctors the patient was moved from the intensive care into their ward.

And people die needlessly (a few examples are at link, link, link).

As reports of patient harm began to emerge, the federal Office of the National Coordinator (ONC) for health IT asked the Institute of Medicine (IOM) a year ago to establish a Committee on Patient Safety and Health Information Technology to make recommendations to the government about how to maximize health IT safety.

I would rephrase that to: as reports on patient harm were no longer able to be suppressed by the industry...

In its report, the IOM committee says the FDA would likely restrict market innovation in health IT, which could also jeopardize patient safety.

There has been little to no real "innovation" in health IT in well over a decade; if anything, the usability and quality has deteriorated. Further, there is no data supporting the contention that FDA regulation of IT harms innovation. Pharma IT (regulated) is far more innovative than the IT in healthcare delivery (unregulated).

Stringent regulations “can negatively impact the development of new technology by limiting implementation choices and restricting manufacturers’ flexibility to address complex issues,” the report says.

Bull. It will keep the companies honest and "encourage" them to adhere to good software engineering and usability principles (unlike here), which will save lives. It's unfortunate such "encouragement" is needed, I note.

The FDA currently receives voluntary reports [7] of health IT-related incidents, but has no resources or protocols through which to take action; the agency has long fought a losing battle [8] with health IT vendors over trying to monitor the technology. The report also notes the agency does not have the investigative capabilities, funding or manpower to regulate devices such as electronic health records, personal health records or health information exchanges.

Then give them the resources, not develop an entire new agency. The FDA has the talent and experience. [Note: I have no connections to FDA whatsoever - ed.]

... To adequately oversee health IT safety, the committee recommends that the secretary of health and human services create and fund a new independent watchdog agency, along the lines of the National Transportation Safety Board. Like NTSB, the new agency would conduct investigations and make recommendations for all stakeholders, including the secretary of the health and human services, vendors and health care organizations. Vendors of the technology would be required to report adverse events, while reporting would be voluntary for clinicians. Like NTSB, though, the new agency would also have no enforcement power.

That is to say, it will be toothless and ignored, leaving a cavalier industry that should have gotten its act together twenty years ago to continue on with its nihilistic ways.

The panel also recommends that the HHS secretary publicly report on the progress of health IT safety each year, beginning in 2012. If the secretary determines at any time that adequate safety progress has not been made, only then should the FDA take the regulatory lead and be given the resources to do so, the report recommends, adding that the agency should be developing a framework now to be prepared.

This makes little sense. In fact, it's an extraordinary special accommodation to the health IT industry (or should I say lobby) relative to other healthcare medicine/device sectors, and is bizarre. It continues health IT as a human subjects research experiment without informed consent and opt-out.
With catastrophe-inviting events like this one becoming more commonplace, just how many patients will have been maimed or died in the meantime while the HHS Secretary's 'determination of adequate safety progress' is being made? (What, exactly, will be deemed 'adequate', I also ask?)

Creating a new independent agency would, of course, require resources; the current budget for NTSB is set at $559 million over the 2010 to 2014 period. In the current climate of fiscal restraint, convincing Congress to appropriate that sort of cash for a new government body might be a tall order.

I note that it's a waste of taxpayer money to create a new agency to maintain/increase health IT industry profits at the expense of patients - not a wise choice IMO.

... Republican Sen. Chuck Grassley [11] of Iowa, senior member of the Senate Finance Committee, said the new report “adds more to the list of unresolved questions, including which government agency, if any, should regulate health care information technology.” Grassley, who wrote [12] HHS and health IT vendors two years ago asking what was being done to ensure the safety of the devices, said “the approach seemed to be, write checks first, solve the problems later, instead of the other way around.”

Having spoken extensively with Sen. Grassley's staff on these issues, I agree - except for the "seemed to be" disclaimer. Replace "seemed to be" with "was."

The Institute of Medicine committee does have one dissenter. Dr. Richard Cook [13] from the University of Chicago feels the FDA is indeed the proper agency to oversee health IT safety. Cook writes that health IT is considered a “Class III medical device,” that is to say, a device that performs integral medical functions, which the FDA already has the jurisdiction to regulate.

Dr. Cook is a co-author of the short 2005 paper "Hiding in plain sight: What Koppel et al. tell us about healthcare IT" which I consider seminal in understanding why health IT as it exists today is so poorly done.

In its report, the IOM panel also recommended that another study be done to quantify health IT-related deaths, serious injuries or unsafe conditions so that the safety concerns can be properly addressed. “You can only improve what you measure,” says the report.

As I wrote in Oct. 2010, that is putting the cart before the horse again. We study these issues while a national rollout under threat of penalty is underway? That's simply crazy.

Other recommendations in the report: establishing and enforcing criteria for the safety of electronic health records, funding a new Health IT Safety Council to set standards for safety, and requiring all health IT vendors to publicly register and list their products with the Office of the National Coordinator.

No issues there, except these efforts should have occurred over a decade ago, at the latest.

Finally, while I disagree with the action agenda, I do thank the IOM for bringing the issues of health IT risks out into the sunlight. Perhaps now these issues will start to be addressed, and ultimately patient safety and human rights safeguarded.

From the report's introduction:

... Caught in the middle are the patients—the ultimate recipients of care. Stories of patient injuries and deaths associated with health information technologies (health IT) frequently appear in the news, juxtaposed with stories of how health professionals are being provided monetary incentives to adopt the very products that may be causing harm. These stories are frightening, but they shed light on a very important problem and a realization that, as a nation, we must do better to keep patients safe ... the entire committee believes the current state of safety of health IT must not be permitted to continue.

I've been writing words like that for over a decade.

-- SS

Addendum Nov. 8, 2011:

The IOM has issued this press release:

From: National Academies News <InternetMailforONPI@nas.edu>
Date: November 8, 2011 8:25:43 AM PST
To: National Academies News <InternetMailforONPI@nas.edu>
Subject: Health Information Technology and Patient Safety - For Immediate Release

Health Information Technology and Patient Safety – For Immediate Release

Health IT and Patient Safety: Building Safer Systems for Better Care, a new report from the Institute of Medicine, is available for IMMEDIATE RELEASE. The report examines a broad range of health information technologies and recommends actions that the government, health care providers, and technology vendors should take to improve patient safety. Contrary to some early news accounts, the report does not recommend that a new agency be established to regulate these technologies. Reporters can obtain a copy of the report by contacting the National Academies' Office of News and Public Information; tel. 202-334-2138 or e-mail news@nas.edu. In addition, members from the committee that wrote the report will discuss their recommendations and take questions at a one-hour public briefing starting at 10:30 a.m. EST Thursday, Nov. 10, in Room 100 of the National Academies’ Keck Center, 500 Fifth St. N.W., Washington, D.C. Those who cannot attend may participate through a live audio webcast accessible at http://www.nationalacademies.org.

I am not sure why they state "Contrary to some early news accounts, the report does not recommend that a new agency be established to regulate these technologies."

From the report prepub, page 6-28 to 6-29:

... To truly improve patient safety, a new approach is needed. The committee believed that the experiences of other industries such as transportation and nuclear energy in creating the NTSB and the NRC were instructive, and concluded that the development of an independent, federal entity was best suited to performing the needed above-described analytic and investigative functions for health IT–related adverse events in a transparent, nonpunitive manner. The committee envisions an entity that would be similar in structure to the NTSB or the NRC, which are both independent federal agencies created by and reporting directly to Congress.

Among other responsibilities, these entities conduct investigations, for the purpose of ensuring safety. NTSB is a nonregulatory agency that does not establish fault or liability in the legal sense but investigates incidents. The NRC is a regulatory body that has the ability to issue fines and fees. The committee considered both agencies and concluded the NTSB to be most similar to the needs of health IT–assisted care.
An independent, federal entity analogous in form and function to the NTSB is needed. This entity would not have enforcement power and would be nonpunitive. Instead, it would have the authority to conduct investigations and, upon their completion, make recommendations.

This recommendation followed:

... Recommendation 8: The Secretary of HHS should recommend that Congress establish an independent federal entity for investigating patient safety deaths, serious injuries, or potentially unsafe conditions associated with health IT. This entity should also monitor and analyze data and publicly report results of these activities.

Hopefully this issue will we clarified when the final report is generally available and the public briefing occurs.

I hope it's not an issue over the word "entity" vs. "agency", a difference that in practice would probably make no difference, economically speaking.

Addendum #2, Nov. 8, 2011:

After re-reading all of this, it seems the issue at question in the National Academies press release above is "regulation" vs. "investigating and monitoring."

That apparently being the case, let me state again that I have problems with the fact that the recommendations seem to preclude true regulation that should start ASAP, not at the whim of the Secretary of HHS when he/she decides that "adequate safety progress has not been made."

That represents, in my opinion, a special accommodation to the healthcare IT industry as previously mentioned.

In fact, Dr. Cook had a dissenting recommendation in Appendix E of the report that I agree with:

Recommendation 9: The Secretary of Health and Human Services should direct the FDA to exercise its authority to regulate health IT, including all EHRs and associated components, and health information exchanges, as Class III medical devices. [Under the 1976 Medical Device Amendments to the Federal Food, Drug, and Cosmetic Act - ed.]

-- SS

[Note] Regarding the IOM, my presenting in person the events that led to my relative's travails was rejected on the basis of 'protocol.' Despite the remarkable aspect of a physician/Medical Informatics specialist's relative (in fact, a specialist writing on health IT risks for over a decade) being gravely injured as a result of health IT-related disruption of care continuity, despite support for my personal attestation by internal members of the study group, my live testimony was rejected. Considering the issues were not just relevant to the IOM study, but at its heart, the rejection on procedural grounds brings to mind the simian adage "see no evil, hear no evil, speak no evil." The Institute of Medicine, on matters of life and death, acted more as an "Institute of Protocol" (or perhaps "Institute of Politics") in my opinion than an institute of science. I believe this lessens the credibility of their action agenda.