November 2016

Don't Let BYOD Become OMG
By Dave Yeager
Radiology Today
Vol. 17 No. 11 P. 22

Many organizations have bring-your-own-device policies, but are they managing those devices effectively?

For many years, accessing radiology images and other clinical information on personal mobile devices such as smartphones and tablets was considered taboo among most health care organizations. The practice was deemed too risky because of questions about device security and especially HIPAA compliance. In recent years, however, that resistance has begun to soften.

The turning point, says Mike Gray, principal of Gray Consulting, was the advent of the zero-footprint web viewer, which eliminated the need to download specialty viewers to mobile devices. Software downloads often come with security vulnerabilities, but web-based viewers are considered to be much more secure. In the last few years, Gray says the conversation has changed from "May I use my mobile device?" to "I'm using my mobile device, and I should be able to access medical images."

"What happened next is rather fascinating, and it depends on who you're talking to in the organization to even realize that it's going on," Gray says. "Once organizations allowed people to use personal devices to view images, those clinicians began using the cameras on those devices. For example, if I'm a dermatologist, and I'm seeing a patient for the first time for a nasty looking rash, I want to take a picture because I'm going to prescribe an ointment, and I want the patient to come back in a week. Then, I'll take another picture so I can compare it to the first picture. Sounds like a perfectly viable thing to do, if you're a dermatologist. But if you spread this workflow across all of the other departments, you've got a problem."

Goin' Mobile
Partly due to the ubiquity of mobile devices in almost every other aspect of modern life, they have come to be seen as viable tools for medical providers. That change in attitude has brought questions to the forefront that have lingered in the background for years. Aside from securing personal health information (PHI) in a HIPAA-compliant way, how should data that are shared or captured on mobile devices be managed? And how much is it going to cost?

Despite these unanswered questions, mobile devices aren't going away. A Pew Research Center study published in April 2015 found that 64% of Americans have a smartphone. David J. Marichal, RT(R)(CT)(MR)(ARRT), CIIP, president of Sunetos Solutions, LLC, expects that a growing number of health care providers will incorporate mobile devices into their practice, particularly younger practitioners.

"If you look at the up-and-coming generation of health care professionals and patients, these devices are only going to become more prevalent," Marichal says. "What we are seeing is, the next generation of health care providers and health care consumers are going to be more and more dependent on these devices."

That's not necessarily a bad thing. Marichal believes that there are numerous potential uses for mobile devices, such as first responders using them to communicate with physicians in real time about triage and emergency medical care. He expects that images and videos captured from these encounters, as well as possibly GPS data, will eventually need to be incorporated in the medical record.

Currently, other visible light images such as dermatology pictures, endoscopy videos, and before-and-after pictures of treatment responses from interventional clinics are making their way into clinical practice. These images not only hold clinical value but a growing number of consumers also want access to them. The Pew study found that 62% of respondents had used their smartphones to look up information about medical conditions. Marichal says organizing these images in a user-friendly way will drive consumer interest.

"As personal health records and portals become better interfaced so you're not having to log into 50 of them, I think more and more people are going to expect that they'll be able to pull up their records and see their X-rays, not just their report but [also] the images that go along with it," Marichal says. "As the technology improves and becomes more human friendly in terms of the output, that changes the consumer perspective tremendously because a lot of people want to see or share their images."

Still, consolidating, managing, and sharing images created on mobile devices will require changes in organizational behavior. Marichal believes that pictures and videos will eventually become part of the patient chart, but he notes that the legal issues surrounding mobile devices are unclear. Gray says organizations that don't have policies and procedures in place to address how PHI is handled on mobile devices face a difficult decision about whether to allow BYOD.

"Now we have a problem. We have a very viable clinical need and an, obviously, very inexpensive solution, but it's out of control in that it's not secure. And in addition to it not being secure, by definition, these are hundreds of islands of data, exactly what we're trying to get away from when we talk about islands of data in radiology, cardiology, and other departments," Gray says. "Telling somebody that they can't do something that runs contrary to patient care is tough. So it raises the question: What are we going to do?"

Shining a Light on Dark Data
Kim Garriott, principal consultant for Logicalis Healthcare Strategies, says mobile devices typically gain initial notice from hospital administrators as a HIPAA risk because they are being used to acquire patient data. This usually prompts the administrators to seek a solution. Garriott, who worked with Cleveland Clinic on their massive enterprise imaging project, says a lack of governance structure in many organizations makes it extremely difficult to control the flow of images, especially images from mobile devices. Policies and procedures for capturing and sharing data need to be put in place by the organization's top decision-makers.

Once those policies are determined, the organization needs to figure out how many departments are generating content and where that content is stored and managed, adds Terron Bruner, vice president of enterprise imaging at Lexmark Healthcare.

"When we first started talking to our customers about enterprise imaging and trying to get a picture of how many images they were generating, the one universal thing that came up across our customer base was that no one knew exactly how many images they were generating per department," Bruner says. "As we perform discovery exercises with our customers, we are consistently finding images that live on PCs, hard drives, and various proprietary systems. There's literally unstructured content or, as we might call it, 'dark data,' that lives throughout organizations."

Compounding the problem, Garriott says, is a lack of ability to assign metadata to non-DICOM images such as digital photos. In most cases, there is no structure in place to associate the acquired image with pertinent patient data, including a standardized naming description, so other providers can easily see which part of the body the image was taken from. Garriott says this greatly limits the ability of providers to coordinate care.

"It also severely hampers us from ever being able to perform any kind of predictive analytics or the ability for our systems intelligence to help us track the progression of a skin condition over time," Garriott says. "Without the assignment of proper metadata, those descriptive attributes assigned at the time of acquisition, it's very difficult, if not impossible, to be able to view a longitudinal comparative history of that patient's wound or area of interest."

Effective policies, comprehensive image discovery, and appropriate association of patient images are all part of an effective enterprise imaging strategy. A well-executed strategy can reduce or eliminate data siloes, a goal that has been one of the main drivers behind vendor neutral archive (VNA) and enterprise imaging solution adoption. Eric Rice, chief technology officer of Mach7 Technologies, says a growing number of organizations are moving in this direction.

"Just as the EMR has consolidated all of the [text-based] data, I believe the CIOs and health systems are looking to consolidate all of their [image] data," Rice says. "Radiology and other departments are always going to need their specialty viewers that do the measurements the way they need them done, but I do believe we'll start to see more and more of the data consolidated in an enterprise imaging platform. That image data will get consolidated and connected with the electronic medical record."

Even if a comprehensive technology solution is not in the budget, Garriott says there are steps that can help an organization gain control of its mobile devices. While enterprise imaging platforms and VNAs are one option, there are also less expensive technology solutions available. For example, some vendors are developing digital apps for mobile devices that provide a secure login, a link with the EHR patient lists, and the ability to select the appropriate patient and the image description from a drop-down menu at the time of acquisition. The images are either automatically deleted from the mobile device after they are transferred to the secure storage capacity or they are never resident on the device in the first place. The key, Garriott says, is that there are no "one-size-fits-all" solutions.

"Not every organization is positioned to go out and spend money on an application that is all-contained and gives you everything you need," Garriott says. "My advice to organizations in general, outside of making an investment, is to work closely with your EHR provider to ensure that you're leveraging the existing technologies that you have within your EHR to the fullest capability and that you work with the governance structure inside your organization to develop data standards specifying the minimal set of information that you want your providers to capture with those images."

At What Cost?
One of the biggest challenges with mobile device–generated images is determining what they're worth. Radiology studies are reimbursable, which more than covers the cost of storing them. Finding an appropriate price for nonreimbursable images can be difficult. This is one reason that health care organizations and vendors are beginning to rethink traditional storage models.

"In the radiology and cardiology world, we're charging based on their number of procedures," Rice says. "But in the dermatology/wound care world, they're not getting reimbursed for the photos they're taking. They just want to have the photos for clinical reference to see if, six months from now, the mole has changed shape and color. So, more and more, we're seeing user- and department-based pricing options. For example, if you need 10 concurrent users, you would base it on a per-user basis."

Morris Panner, JD, CEO of Ambra Health, says changes in other areas of health care will also affect the storage strategies of health care organizations. He expects storage to be handled in a similar way as most consumer digital storage. Panner says this change is likely to occur because storage volumes are exponentially increasing and value-based incentives and bundled reimbursements may eventually phase out direct reimbursement for radiological studies. The emphasis, he believes, will be on customer-based data management.

"It gets at what you're starting to see in every other part of your life. The storage is effectively bundled with the workflow functionality," Panner says. "What we do is approach customers with the premise that it's their storage, which they will be able to manage as they see fit. If there's overage above this storage—the same way that you would with an iCloud account or any of your other consumer companies—you're going to have to pay extra; the focus is going to be on the workflow engine and software tools that let you interact with all of this data."

Bruner says he's also seen interest in more hands-on management. He says some customers are taking advantage of image lifecycle management (ILM) capabilities. Although many organizations prefer to store all of their images indefinitely, ILM may become more popular as storage and management models change. In either case, Bruner says it's important for organizations to develop an organizational philosophy around data management.

"It's a hot topic in every meeting that we have. How long should you keep a certain image or video, whether it be radiology or dermatology or wound care? That's something that can't be decided in a vacuum," Bruner says. "There has to be some universal thought about the technology that you have deployed and whether or not you have the ability to truly manage the data that are created … not only at an enterprise level, but you must also be able to account for any nuances of a specific department."

Although mobile devices will have a much larger effect outside of radiology, radiology can still shape an organization's data management process. Radiology's experience with managing imaging data can lend significant insight to dealing with mobile device images, and radiology departments are well positioned to be consultants for these efforts. Enterprise imaging, however, is moving beyond the radiology department.

"Radiology has a special place in understanding imaging and a lot of the technology behind it," Panner says. "But there's no question that enterprise imaging is becoming more of an integrated discipline."

— Dave Yeager is the editor of Radiology Today.