Part 1 Organizational Survival Strategies In this increasingly difficult economic environment, many organizations have been forced to take drastic operational and systematic measures to stay afloat an

EXAMPLES OF SUCCESSFUL CHANGE

Managers foster a change-ready environment by reminding the work group of successful changes. This raises the comfort level of the group and provides insight into strategies for achieving desired outcomes. Six examples are provided here to illustrate the process of successful change:

• Year 2000 (Y2K): change as opportunity

• Patient Self-Determination Act (PSDA): routinization of change

• Health Insurance Portability and Accountability Act (HIPAA): extensive change via legislation

• Electronic health records: proactive change

• Economic and market forces: anticipatory readiness through organizational restructuring

• Disruption in personal circumstances: revitalization through career development

Change as Opportunity: Y2K

Recall the transition to the new century: Y2K. The phrase alone reminds us of successful responses to an inevitable change. It also reminds us of the pre-Y2K concerns about technology-dependent systems: would they work? Faced with the possibility of massive systems failure, managers carefully defined the characteristics of this anticipated change:

1. A definitive event with an exact timetable

2. Well known ahead of time (3- or 4-year run-up)

3. Unknowns or uncertainty mixed with known technical aspects: which systems might fail, what would the resulting impact be (e.g., failure of power grids, communication disruption, financial infrastructure chaos)

During the run-up to Y2K, managers assessed the potential impact and planned accordingly. Furthermore, many managers seized the opportunity to make even bigger changes. When the cost of upgrading some existing systems was compared with adopting new systems, managers chose to spend the money and time on a comprehensive overhaul.

Funding such a major project became part of the challenge. Many chose a combination of borrowing, along with “bare bones” budgets, with deferred maintenance and elimination of discretionary projects (e.g., refurbishing) to meet this need. The end result in many organizations was the adoption of new, well-integrated computerized systems. This overall plan of upgrading was supplemented with contingency planning closer to the December 31, 1999, deadline. Managers took such practical steps as:

• Eliminating all backlogs (e.g., coding, billing, transcription)

• Preregistering selected patient groups (e.g., prenatal care patients)

• Obtaining and warehousing extra supplies

• Adjusting staffing patterns for the eve of Y2K and the days immediately following it, with workers available and trained to carry out manual backup for critical functions

Managers also took the opportunity to review and update the emergency preparedness and disaster plans for the healthcare organization. Again, the anticipated Y2K change was the catalytic agent for renewed efforts in these areas. Y2K came and ran its course; the change was absorbed with relative ease because of careful planning.

The Routinization of Change: The Patient Self-Determination Act of 1990

End-of-life care and related decisions have always been a part of the healthcare environment. However, technological change (e.g., advances in life support systems) along with definitive court cases (e.g., Quinlan, Cruzan, Conroy) led to a renewed interest in these issues. This interest, in turn, resulted in the passage of the PSDA, which had implications for patient care as well as the administrative support systems.

The response to this change was orderly and timely because the healthcare providers and the administrative teams assessed the change in a systematic manner. This strategy of absorbing change through rapid routinization into existing modes of practice included the following:

1. Outreach to clients or patients and their families, along with the public at large, to provide information and guidance about healthcare proxies, advance directives, and living wills. Information about support services such as social service, chaplaincy, and hospice care was included as part of the regular client/patient education programs.

2. Review and update of do not resuscitate (DNR) orders and related protocols for full or selected therapeutic efforts.

3. Review of plan of care protocols for “balance of life” admissions.

4. Increased emphasis on spiritual and psychological considerations of patients and families, with documentation through values history or similar assessments.

5. Renewed involvement of the ethics committee of the medical staff to provide the healthcare practitioner, patient, and family with guidance. The committee also adopted review protocols to assess patterns of compliance with advance directives and end-of-life care.

6. Documentation and related administrative processes augmented to reflect the details of this sequence of care (e.g., documentation that an advance directive was made, movement of the document with the patient as he or she changed location, flagging the chart to indicate the presence of the directive). Existing policies and procedures were updated to reflect these additional practices.

The changes stemming from the PSDA were easily managed through systematic review and adjustment of existing, well-established routines. However, there is a potential downside to routinizing change: the changes might become so well accepted that they are more or less ignored. For example, the living will becomes just another piece of paper or data entry, checked off as being available but not truly part of the care plan.

Because response to legislated change is often required, it is useful to examine yet another such mandate. A consideration of HIPAA reflects a different dynamic in the organizational process of responding to new requirements.

Extensive Change via Legislation: Health Insurance Portability and Accountability Act of 1996

This act, known commonly by the acronym HIPAA, crept inconspicuously on the scene as Public Law Number 104 of the 191st Congress (PL 104-191). When it was a newly passed law, its most visible portion was broadly described by the name of the law, addressing primarily “portability” of employee health insurance.

The intent of HIPAA was to enable workers to change jobs without fear of losing healthcare coverage. It enabled workers to move from one employer’s plan to another’s without gaps in coverage and without encountering restrictions based on preexisting conditions. It proclaimed that a worker could move from plan to plan without disruption of coverage.

In 1996, a great many healthcare managers did not concern themselves with HIPAA. Human resources managers became most aware of the new law because it concerned their benefits plans, but the burden of notification was borne mostly by the employers’ health insurance carriers, so there was little to do other than answering employees’ questions. For many managers, the employer had no concerns about HIPAA beyond ensuring health insurance portability. But HIPAA’s major impact was to come later, and its arrival was a genuine eye-opener for many. This law consists of five sections: titles I, II, III, IV, and V.

Title II in the Spotlight

Titles I, III, IV, and V of HIPAA deal with employee health insurance, promoting medical savings accounts, and setting standards for covering long-term care. Title II is the section driving most HIPAA-related change. This section is called “Preventing Health Care Fraud and Abuse, Administrative Simplification, and Medical Liability Reform.” It is referred to as just Administrative Simplification, a term that is misleading at best; for many of the organizations that have had to comply with it, the effects have been anything but simple.

Administrative Simplification includes several requirements designated for implementation at differing times. Compliance with the Privacy Rule, the most contentious part of HIPAA, was required by April 14, 2003. Compliance with the Transactions and Code Sets (TCS) Rule was required by October 16, 2003, and the Security Rule was set for implementation in April 2005. The Centers for Medicare and Medicaid Services have issued, and continue to issue, a wide variety of rules and guidelines, with managers implementing these routinely. HIPAA has become a fixed feature in healthcare systems.

Nearly all of the controversy over the intent versus the reality of HIPAA involves the Privacy Rule. In trying to strike a balance between the accessibility of personal health information by those who truly need it and matters of patient privacy, portions of HIPAA have created considerable work and expense for healthcare providers and organizations that do business with them, not to mention creating inconvenience and frustration for patients and others.

The Continuing Privacy Controversy

Reactions to the Privacy Rule have been numerous. Patients and their advocates claimed that these new requirements were forcing a choice between access to medical care and control of their personal medical information. Government, however, claimed that the rules would successfully balance patient privacy against the needs of the healthcare industry for information for research promoting public health objectives and improving the quality of care.

When HIPAA’s privacy regulations first received widespread exposure, hospitals, insurers, health maintenance organizations, and others claimed that the Privacy Rule would impose costly new burdens on the industry. At the same time, Congress was claiming that HIPAA’s protections were immensely popular with consumers. Consumer advocates hailed the Privacy Rule as a major step toward comprehensive standards for medical privacy while suggesting that it did not go far enough.

To comply with the Privacy Rule, affected organizations were required to

• Publish policies and procedures addressing the handling of patient medical information

• Train employees in the proper handling of protected health information

• Monitor compliance with all requirements for handling protected health information

• Maintain documented proof that all pertinent requirements for information handling requirements are fulfilled

In many instances, the HIPAA privacy requirements are causing frustration for patients and others. For example, a spouse who has to help obtain a referral or follow up on a test result cannot do so without the signed authorization of the patient (unless the patient is a minor). Anyone other than a minor or a legally incapable or incapacitated individual must give written permission for anyone else to receive any of his or her personal medical information.

There are a number of instances in which personal medical information can be used without patient consent. These instances, along with all patients’ rights concerning personal medical information, must be delineated in the Privacy Notice that every provider organization must provide to every patient.

Effects on an Organization

All healthcare plans and providers must comply with HIPAA. Provider organizations include physicians’ and dentists’ offices; hospitals, nursing homes, and hospices; home health providers; clinical laboratories; imaging services; pharmacies, clinics, and freestanding surgical centers and urgent care centers. In addition, such organizations include any other entities that provide health-related services to individuals. Also required to comply are other organizations that serve the direct providers of health care (e.g., billing services and medical equipment dealers). All affected organizations must

• Protect patient information from unauthorized use or distribution and from malfeasance and misuse

• Implement specific data formats and code sets for consistency of information processing and preservation

• Set up audit mechanisms to safeguard against fraud and abuse

All subcontractors, suppliers, or others coming into contact with protected patient information are also required to comply with the HIPAA Privacy Rule. In addition, all arrangements with such entities must define the acceptable uses of patient information.

Depending on organization size and structure, compliance with the HIPAA Privacy Rule could involve several departments (as in a mid-size to large hospital), a few people (as in a small hospital or nursing home), or a single person (as in a small medical office). Overall, whether compliance is accomplished by separate departments or just a person or two, compliance can involve a number of activities, including information technology, health information management, social services, finance, administration, and ancillary or supporting services.

The necessary changes have been numerous and have added to the workload in every affected area. Providers routinely obtain written consent from patients or their legal representatives for the use or disclosure of information in their medical records, as had been the standard practice. However, renewed attention has been focused on release of information practices. Also, providers are now legally required to disclose when patient information has been improperly accessed or disclosed.

The Privacy Rule created a widespread need for healthcare providers to revise their systems to protect patient information and combat misuse and abuse. Providers now must protect patient information in all forms, implement specific data formats and code sets, monitor compliance within their organizations, implement appropriate policies and procedures, provide training all in HIPAA’s privacy requirements, and require the organization’s outside business partners to return or destroy protected information once it is no longer needed. Also, it is not enough simply to do everything that is supposed to be done: there are also a number of documentation requirements as well. Even a provider organization’s telecommuting or home-based program must be HIPAA compliant.

Physical Layout Considerations

The HIPAA Privacy Rule has necessitated changes in physical arrangements to ensure that no one other than the patient and caregiver or other legitimately involved person knows the nature of the patient’s problem—or even, for that matter, that the specific individual is a patient. Medical orders or information about an individual’s condition must be conveyed with a guarantee of privacy. Numerous organizations had to move desks or workstations, erect privacy partitions, provide soundproofing, and make other alterations so that no one other than those who are legally entitled to hear may overhear what passes between patient or representative and a legitimately concerned party.

The Privacy Official

Every healthcare provider organization must have a person designated to oversee HIPAA compliance. In a large organization, this position could be filled by a full-time HIPAA coordinator. In a small organization, such as a medical office, the task might be an additional responsibility of the office manager. This person must monitor all aspects of compliance and ensure that appropriate policies and procedures are maintained and kept current. Professional associations, including the American Health Information Management Association (AHIMA), have developed detailed position descriptions and guidelines for privacy officers.

The Department Manager and HIPAA

Depending on the nature of a department’s activity, HIPAA’s requirements could significantly affect the manager’s role. For example, in addition to most managers’ involvement with the Privacy Rule, some person working in health information management must be concerned with the TCS rule. A manager within information technology or information systems will be significantly concerned with the Security Rule because of its relevance for information stored or transmitted electronically.

As with other laws affecting the workplace, there is much more to compliance with HIPAA than simply putting policies, procedures, and systems in place. Some HIPAA regulations are complex, and in the most heavily affected areas of an organization, considerable training can be required. Also, HIPAA necessitates some training for most staff regardless of department; any person who comes into contact with protected patient information must receive privacy training. As a consequence, most managers will be both trainees and trainers, learning HIPAA’s privacy requirements and communicating them to employees.

Not Going Away

Some HIPAA requirements continue to be amplified, and it is clear that the law’s basic privacy requirements are here to stay in one form or another. Privacy rules will continue to affect every physician, patient, hospital, pharmacy, healthcare provider, and all other entities having contact with patient medical information in any form. The American Recovery and Reinvestment Act of 2009 and the related Health Information Technology for Economic and Clinical Health Act amplify privacy practices, with particular emphasis on breach notification. The breach notification provisions include detailed regulations touching on the following issues:

• Notification of individuals if there is significant risk of financial, reputational, or other harm

• Time frames and manner of notification

• Tracking and reporting

• Internal compliance monitoring systems

HIPAA has brought with it a considerable amount of unwelcome, unwanted, and frequently burdensome change affecting the jobs of many healthcare managers. Because the requirements of HIPAA are government mandates, the individual manager has no option but to comply. The manager’s challenge, then, is to conscientiously approach the necessary changes in the role and incorporate them so that they are addressed as efficiently and effectively as possible.

As an unexpected positive outcome of HIPAA-related actions, the health information management environment has been primed to undertake major efforts in expanding electronic health records.

A Study in Proactive Change: Electronic Health Records

Implementation of electronic health records reflects a proactive approach to change. The application of technology to enhance the creation and use of healthcare information has been a welcome advance. The migration from hard copy records and systems to automated ones represents change, both incremental and rapid. Data gathering and analysis via punched cards in the early 1960s was a precursor of advances to come. As the country became accustomed to electronic capture, exchange, and use of information as a result of the new technology (the credit card—easy to use, easy to carry), smart cards with embedded personal health information were a highlight in the early 1970s. Why not apply the same idea to one’s personal information? Applications of smart cards in the late 1980s included patient’s use of interactive behavioral healthcare protocols. Throughout this period, automated and outsourced administrative processes were adopted readily. The Y2K events occasioned a thorough review of systems. Advances in technology, plus related legislation in favor of electronic health records, have resulted in rapid change and a cascade of changes. Note, by way of example, the adoption of Health Level-7 standards, the creation of a national health information technology coordinator and the national health information technology plan, and such specific legislation as the Medical Modernization Act and its mandates concerning electronic prescription systems.

The electronic health record incentive program provided an additional catalyst for the adoption of this massive system change. Yes, the technology is continually evolving, but the underlying principle is enduring: quality health information for use in patient care, research, and administrative support. Legislative mandates requiring universal adoption of electronic health records further reinforce this ongoing professional mission.

Health information practitioners have taken leadership roles in their workplaces and through their national association, AHIMA, along with its state component organizations. A strategy for proactive engagement with these changes was developed and continues to be applied as the migration from hard copy to electronic information systems unfolds. The overall strategy has six features:

1. Individual initiative within the workplace

2. Advocacy in the public arena

3. Partnership with key stakeholders

4. Outreach to clients and patients

5. Continual adjustments to information systems

6. Reassessment of health information management job roles and credentialing

Individual Initiative

Within the workplace, individual health information managers have steadily adopted computer technology to support basic operations. Workflow and processes have been gradually converted over time, including automated master patient indexes, coding and reimbursement processes, digital imaging, and speech recognition dictation. Internal administrative systems have served as building blocks for the expansion of computerized systems to include electronic health records. Although individual initiative continues to be an important facet of this transition, fostering change through advocacy has been primarily an organized group effort through the national association, AHIMA.

Advocacy in the Public Arena

External forces, particularly law and regulation, are affecting the process of developing electronic health records. It is essential, then, that professional practitioners help shape the debate, contributing their knowledge and expertise through organized efforts. Regular interaction with lawmakers and regulatory agency officials has been central to this process. Participation in work groups, task forces, and special initiatives has been steady. Landmark events bear the imprint of such involvement, including the Centers for Disease Control and Prevention’s Public Health Information Network to implement the Consolidated Health Informatics standards, the Public Health Data Standards Consortium, the Department of Health and Human Services (DHHS), the American Health Information Community and its initiatives toward creating a national health information network, and the Certification Commission for Healthcare Information Technology.

Partnerships with Key Stakeholders

The health information profession has long been the authoritative source of practice standards. With the advent of electronic health records, many of the questions that have arisen are variations of issues with which health information management practitioners have successfully dealt. Those experiences have prepared these practitioners to offer guidance in such areas as documentation content and standardization, authentication of documentation, informed consent, accuracy of patient information, access and authorized use of data, and data security.

AHIMA has developed a series of position papers, statements of best practices, and guidelines for these and related topics. This organization has strengthened its efforts through partnership with key stakeholders, as the following examples demonstrate

• American Health Information Community (DHHS): standards for electronic health data

• American Medical Informatics Association: data standards

• Medical Group Management Association: performance improvements and need for consistent data standards

• National Library of Medicine: data mapping (e.g., Systematized Nomenclature of Medicine and International Classification of Disease interface)

• American Society for Testing and Materials and its committee on health informatics: core data elements and definitions

• Corporate partner industry briefings: cosponsored exchange sessions

Through these and similar outreach efforts, AHIMA makes available valuable guidance to those involved in adopting electronic health records.

Another major initiative by AHIMA has been the move toward open membership. In recognition of the important partnership with information technology specialists, clinicians, and others with a shared interest in health information, as well as to foster even greater teamwork, the AHIMA members voted to eliminate associate membership, moving this group into the active membership category. An open, inclusive membership provides additional strength to the association in its efforts to support the electronic health record initiative.

Outreach to Clients and Patients

Consumers are an important partner in the effective use of electronic health records. AHIMA has developed an initiative to raise public awareness of these personal health records. As part of this initiative, individual health information practitioners, using AHIMA-created presentations, interact at local and regional levels with consumer groups such as local chambers of commerce, health fair coordinators, and specialty support groups (e.g., cancer support groups). Participation in the Blue Button initiative (begun by the Department of Veterans Affairs) has provided another opportunity to educate the public about electronic health records. Presentations and articles by health information management professionals concerning the health information exchange or “how to” explanations about accessing an electronic health record for one’s personal use have fostered patient engagement in this unfolding endeavor.

An important adjunct to this outreach is advocacy. Clients and patients must continue to have trust in the process of revealing their personal information fully and truthfully during healthcare interactions. AHIMA continues to press for specific protective legislation with a nondiscrimination focus: protect the patient from any discriminatory action stemming from documented information about patient care encounters.

Continual Adjustments to Information Systems

In summary, electronic health record initiatives reflect the best in proactive involvement by managers in facing major change. As the transition from paper to electronic records continues, AHIMA has provided position papers, best practices guidelines, and training materials including document imaging to link paper documents to electronic health records, along with retention guidelines for postscanning management of data; “copy and paste” guidelines; making corrections, amendments, and deletions to ensure record integrity; the definition of the legal record; and e-discovery rules under federal rules of civil procedures.

Reassessing Health Information Management Job Roles and Credentialing

The changing landscape of health information management job roles and functions has produced associations that periodically review this work. Such evaluation has become a more urgent priority as attention to the need to reassess both traditional jobs as well as emerging ones. Logical steps have included identifying the new configuration of jobs and role sets, identifying the associated knowledge and competencies, and developing and expanding the educational preparatory levels (associate, bachelor’s, and master’s degrees, as well as graduate certificate in healthcare informatics). The credentialing process has also been expanded to include new categories of specialization (e.g., Certified Documentation Improvement Practitioner, Certification in Healthcare Privacy and Security).

Economic and Market Forces: Anticipatory Readiness Through Organizational Restructuring

Sometimes an organization as a whole faces severe circumstances caused by economic and market forces. Consider the situation of a facility offering two levels of care for frail, elderly people: personal care and assisted living. This facility opened 40 years ago and has been in the same physical building since then. It has had a history of modest but steady success. An analysis of the balance sheet reflected breakeven points for 11 of the 40 years and 14 years of modest profit. Only the first few years showed yearly losses, primarily because of startup costs. Then, most recently, there was a 5-year run of steady loss and increased debt, due to increased competition in local market and to the need for expensive renovations to the 40-year old physical facility. Decreasing reimbursement rates from third-party payers added to this erosion of revenue.

To reverse this trend, the management team undertook the process of preparing the organization to survive and thrive in a new era. The team restructured the organization. It also anticipated probable changes in state law, including those leading to a decrease in skilled care beds through a buy-back provision. Decreased reimbursement for this level of care gave the organization an additional reason to convert some units to increase the size of its dementia care service. Assisted living care was discontinued. The assisted living building was converted to additional personal care and respite care, plus an adult day care center. Comprehensive home care services, using a contractual provider, rounded out the reconfigured services. Through all of these efforts, the organization emerged from its threatened state and became a leading provider in its geographic region.

Disruption in Personal Circumstances: Revitalization Through Career Development

The individual is certainly not immune to the pressure of change. Consider the situation of the health information professional whose family circumstances require increased income over the next several years. This credentialed practitioner had been working part-time as a coding specialist in a community hospital. There were no anticipated resignations in the department management team, and internal advancement was unlikely. Furthermore, this woman needed to remain in the region for family reasons. Recognizing the constraints in her situation, she made and implemented a plan for advancement. First, she utilized the AHIMA career development and self-assessment program to identify competencies needing upgrading. While continuing to work, she undertook master’s degree studies in health informatics and participated in several projects. These projects included research in correctional facilities, juvenile detention centers, and protective service agencies. Through this health information professional’s involvement in local civic activity, an opportunity developed for her to work in first local, and then regional, correctional facilities. She worked first as a part-time consultant and then as the full-time director of the health information department. Both her personal and professional goals were met.