The company quickly remediated the situation by offering customers temporary access to its other clinical documentation technologies. But the disruption for end users, including physicians, was massive.

Since then there have been numerous direct ransomware and malware attacks on hospitals and health systems. Attacks perpetuate disruption, hinder access to clinical documentation, and increase risk to care.  

Business continuity strategies to combat these attacks, though advanced compared to past practice, remain an ever-evolving commitment. And with every step forward, bad actors and cybersecurity threats keep pace. For example, hacking incidents in healthcare rose by 42 percent in 2020 and the total number of patient records breached by hacking has surged according to a recent survey by Protenus, a Baltimore-based healthcare analytics company. 

Lyndon B. Johnson once said, “No experience is a bad experience unless you gain nothing from it.” Since the event, Nuance’s clinical documentation services business line, has invested heavily and worked tirelessly to ensure the safety and resilience of its systems—and the satisfaction of physician users.  On March 1, 2021, DeliverHealth was created as the spin out of Nuance’s HIM business. DeliverHealth carries forward the mission to ensure safe, secure and accessible clinical documentation, and continues to build upon it through education, support and industry guidance. Our guiding principles include: 

• Develop business associate (BA) business continuity and disaster recovery processes, procedures, and protocols to ensure system and service resilience.
• Implement protective technology to manage whatever comes your way including adopting multi-tenant system cloud computing, Azure-hosted security (or equal accountability), redundancy, active-active failover, and regular third-party access monitoring and failover drills on production systems.

Now is the time to check your dictation, transcription, scribing, EHR, and other clinical documentation systems before the next cyberattack threatens your health system’s PHI.

Protecting your clinical documentation systems is not a once-and-done action. It’s an ongoing marathon against cyberattacks for your BAs and internal IT teams.

As such, every clinical documentation solution should deliver the following modernized capabilities to ensure resilience to maintain your business continuity.

Modernizing Your Clinical Documentation Systems 

During the Office of the National Coordinator (ONC) annual meeting in March 2021, the need for data modernization was cited as the best path forward to meet U.S. health challenges. Clinical documentation systems are no exception to this important initiative.

Modernized clinical documentation systems include built-in technology protections to detect hacks, provide active-active failover capabilities, and eliminate business continuity risks. Testing mechanisms and “fire drill” disaster recovery plans with trusted BAs are incorporated into service agreements. Your internal IT team runs business continuity drills all the time—and so should your vendor partners. Demonstrating resilience is a two way street.

While some upfront work is required of hospital IT departments, it is in their best interests to modernize clinical documentation systems.  These system vendors should do the heavy lifting when it comes to training, conversion, privacy, security, redundancy leading to resilience, and failover testing. New capabilities are baked into modern systems to reduce long-term cost, time, and resource demands. They serve as best-practice hallmarks for business continuity and disaster recovery.

Six-Point Checklist for Clinical Documentation Safety: Inspect What You Expect

When considering a modernized clinical documentation partner, there are six specific checklist items to evaluate. These six criteria work together to protect data against disruption and ensure consistent access to your systems.

1. Cloud computing: Cloud-based computing is the first step to ensure high availability, redundancy, and resilience of your clinical documentation systems and data. With a cloud solution, the vendor is responsible for the clinical documentation platform—not your overburdened IT team. Systems are managed in real time and all data is encrypted using current standards. Facilities are SOC 2, SOC 3, and HIPAA compliant, and offer tier 3+ security (armed guards and bioscan for entry).
2. Azure-hosted security center: Azure is Microsoft’s cloud computing service division. While many vendors use Azure, it is important to make sure your clinical documentation partner optimizes the platform’s full potential. And while Azure isn’t the only approach, vendors should at least meet its level and standard. For example, all systems should be monitored continuously with real-time dashboard watching. Any security gaps or irregular traffic can be flagged, and mitigation advice provided. Samples of Azure reports are available here: https://status.azure.com/en-us/status/history/.
3. Redundancy through multiple data centers: Clinical documentation must be available to physicians 24/7/365. Interruptions are not acceptable. Uptime is essential to patient care, physician satisfaction, and downstream revenue cycle processes. Data centers located in multiple geographic regions protect uptime and replicate data to ensure full redundancy and business continuity.
4. In an inevitable event, the focus on redundancy shifts to system and data recovery through recovery time objective (RTO) and recovery point objective (RPO) commitments from the BA. Ask your vendors about RTO and RPO performance. RTO is the time needed to recover core tenets of a disaster recovery strategy. RPO describes data loss and helps to inform the development of a backup strategy. For clinical documentation systems, RTO and RPO should be measured in minutes, not hours.
5. Active-active failover: Failover is the foundation to business continuity. Active-active failover is paramount to acceptable RTO and RPO. Technically, active-active is a high availability (HA) clustering configuration whereby at least two nodes actively run the same system or application simultaneously. This serves to support more effective load balancing to improve throughput and response times. Best practice is to perform failover tests in production regularly. Your partners should be able to perform these tests at any time upon your request, or at the time you review all BA business continuity plans.
6. Redeployment: Compromised systems must be redeployed quickly. This includes servers, cloud native resources, and networks in minutes, not hours. Infrastructure as code and infrastructure release pipelines are critical to this.

Staying Safe, Secure, and Accessible Means Staying Ahead

Threats against your clinical documentation systems are ever present. If something disrupts these systems, your vendor must have proper resilience to recover. And you have an obligation to ensure your BAs can deliver this level of resilience. Patient data, system uptime, physician satisfaction, and revenue cycle are all at stake.

Q: Tell me about your background.

A: Well, I have spent the better part of my career in clinical documentation—with the exception of a short stint in the lighting industry, working with the builder’s association as opposed to AHIMA! I’ve been with Nuance since 2011 when the company I worked for was acquired by them. So, my experience includes more than a little bit of knowledge of the industry and the company, but our new journey as DeliverHealth is exciting.

Q: Have you always been in healthcare? What drew you to the industry?

A: Most of my career has been focused on HIM. But that’s not how it all began. My mother was the Director of Nursing at a small 52-bed hospital, so I grew up in and around healthcare. I worked in the hospital as a teenager and had aspirations of medical school. But there was a different plan for me. I’ve played the piano since I was six years old, which means nothing to my career path except that my dexterity from playing helped my ability to type. And type FAST. So, during college, I worked in the HIM department, and the rest is history. I discovered my aptitude for transcription, and because it was all based on output numbers, I was highly efficient and productive. So productive, in fact, that it prompted the decision to start my own business.

I struck out on my own but soon had employees working out of my house. My little medical transcription enterprise took off. The business flourished, at one point making the Inc. 500 fastest growing companies list, and nine years later I sold it to MedQuist. After working as an SVP at MedQuist for nine years, I took a new path and, for a brief period, went to work in the lighting industry. Healthcare once again beckoned with an opportunity as an SVP for Webmedx, which I jumped on. In 2011, the company was sold to Nuance and that’s where I’ve been ever since. Though it has been a journey with twists and turns, I ultimately adjusted and pivoted when needed. Throughout my career, I’ve followed my talents in a space where I have the most value to share.

Q: What advice would you give to young women who want to go into a healthcare field?

A: Always remember that there are lots of avenues in healthcare. And as life happens, realize that your skills can transfer to those other areas. Healthcare will always be here. The opportunities are endless. Be creative, explore your options and always be intentional in doing your job.

Q: Has the industry changed for women over the course of your career?

A: I’ve definitely seen an uptick in the number of women in leadership positions, though there continues to be room for women to equalize. I would love to see more women in the vendor space in healthcare, and as a former small business owner, I know there are opportunities that women could capitalize on!

Q: Who/what has been the biggest influence on your career?

A: I have had a variety of role models over the years—my mother, for one, was definitely an inspiration. But I think that the biggest influence on my career was having someone tell me that while I was good enough and capable enough for a management position, I was not getting the job. That had a profound impact on me. Knowing that I was worthy and capable, but not being given the opportunity, motivated me to prove that I could do it, on my own. That negative experience has kept me determined over the years.

Q: Working in HIM/clinical documentation, what are your thoughts about the impact women have had on the industry? How does that influence you?

A: Women play such a critical role in all aspects of healthcare that it is hard to not recognize and take great pride in that fact. I have loved every step of my journey, with all its successes, failures, ups, and downs. However, I also know that all of my achievements have not been because I’m a woman, but because I worked at it—because I could. I was smart enough, savvy enough, confident enough. And that’s my message for everyone. Strive to do great things not just because…but because WE CAN.