Bad health IT at Medstar Health: FBI probing virus behind outage (And: ka-ching! ka-ching! EHR costs continue their upward spiral)

computer security healthcare IT risk Hollywood Presbyterian Medical Center medical record confidentiality MedStar Health Patient care has not been compromised

Bad health IT at Medstar Health: FBI probing virus behind outage (And: ka-ching! ka-ching! EHR costs continue their upward spiral)

Unknown 3/30/2016 Komentar

Once again, a definition of bad health IT:

Bad Health IT ("BHIT") is defined as IT that is ill-suited to purpose, hard to use, unreliable, loses data or provides incorrect data, is difficult and/or prohibitively expensive to customize to the needs of different medical specialists and subspecialists, causes cognitive overload, slows rather than facilitates users, lacks appropriate alerts, creates the need for hypervigilance (i.e., towards avoiding IT-related mishaps) that increases stress, is lacking in security, compromises patient privacy or evidentiary fitness, or otherwise demonstrates suboptimal design and/or implementation. (http://cci.drexel.edu/faculty/ssilverstein/cases/)

I observed bad health IT leading to HIT compromise, hospital chaos and paying of a ransom demand at my Feb. 18, 2016 post "Hollywood Presbyterian Medical Center: Negligent hospital IT leaders allow hacker invasion that cripples EHRs, disrupts clinicians ... but patient safety and confidentiality not compromised" at http://hcrenewal.blogspot.com/2016/02/hollywood-presbyterian-medical-center.html.

It's happened again, at least with regard to publicly-disclosed stories (there is no requirement for hospital disclosure, more on that below).

FBI probing virus behind outage at MedStar Health facilities - AP
By JACK GILLUM, DAVID DISHNEAU and TAMI ABDOLLAH March 28, 2016 10:04 pm
http://wtop.com/consumer-tech/2016/03/fbi-probing-virus-behind-outage-at-medstar-health-facilities/


WASHINGTON (AP) — Hackers crippled computer systems Monday at a major hospital chain, MedStar Health Inc., forcing records systems offline for thousands of patients and doctors. The FBI said it was investigating whether the unknown hackers demanded a ransom to restore systems.

A computer virus paralyzed some operations at Washington-area hospitals and doctors’ offices, leaving patients unable to book appointments and staff locked out of their email accounts. Some employees were required to turn off all computers since Monday morning.

A law enforcement official said the FBI was assessing whether the virus was so-called ransomware, in which hackers extort money in exchange for returning a victim’s systems to normal. The official spoke on condition of anonymity because the person was not authorized to discuss publicly details about the ongoing criminal investigation.

Not discussed is corporate accountability for deficient IT security.

“We can’t do anything at all. There’s only one system we use, and now it’s just paper,” said one MedStar employee who, like others, spoke on condition of anonymity because this person was not authorized to speak to reporters.

I note that if the cybernetic pundits were listened to, patients would now be considered at deadly risk due to paper records being used - not due to critical IT infrastructure being hacked and disabled.  Yet it's impossible to disable paper charts en masse.

MedStar said in a statement that the virus prevented some employees from logging into systems. It said all of its clinics remain open and functioning and there was no immediate evidence that patient information had been stolen.

These must be honest thieves.

Of course, we hear the "patient care has not been compromised" line once more (http://hcrenewal.blogspot.com/search/label/Patient%20care%20has%20not%20been%20compromised).

Company spokeswoman Ann Nickels said she couldn’t say whether it was a ransomware attack. She said patient care was not affected and the hospitals were using a paper backup system.

The absurdity of this claim is that if patient care is not affected by returning to paper, then why did the hospital invest hundreds of millions on EHRs?

(Considering a increasing evidence base of clinician distraction and disaffection e.g., the Jan. 2015 Medical Societies letter to ONC as at http://hcrenewal.blogspot.com/2015/01/meaningful-use-not-so-meaningul.html, EHR-related errors, many of which would likely not occur under a well-staffed paper system e.g., as at http://hcrenewal.blogspot.com/2014/04/fda-on-health-it-risk-reckless-or.html, and plentiful security breaches e.g., the many posts at http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy, I would also ask if patient care is in fact improved by the return to paper [1].)

When asked whether hackers demanded payment, Nickels said: “I don’t have an answer to that,” and referred to the company’s statement.

Dr. Richard Alcorta, medical director for Maryland’s emergency medical services network, said he suspects it was a ransomware attack. He said his suspicion was based on multiple earlier ransomware attempts on individual hospitals in the state. Alcorta said he was unaware of any ransoms paid by Maryland hospitals or health care systems.

The rather calmly-stated "multiple earlier ransomware attempts on individual hospitals in the state" suggests that

• Hospitals are being targeted in an organized fashion, and
• Costs to implement proper security will draw even more capital and resources from direct patient care and from real brick and mortar facilities, such as entire new hospital wings that would cost less than an EHR, to cybernetics of increasingly dubious value.  (Past projected cost benefits are certainly being proven even more naive.)
  

Terrorism or just plain old crime, the medical driector asks...

“People view this, I think, as a form of terrorism and are attempting to extort money by attempting to infect them with this type of virus,” he said.

God help us if true terrorists get in the act of cybernetically paralyzing hospitals.

Alcorta said his agency first learned of MedStar’s problems about 10:30 a.m., when the company’s Good Samaritan Hospital in Baltimore called in a request to divert emergency medical services traffic from that facility. He said that was followed by a similar request from Union Memorial, another MedStar hospital in Baltimore. The diversions were lifted as the hospitals’ backup systems started operating, he said.

It used to be that patient diversions were due to doctors and nurses having too many sick patients they are caring for.  Here it seems due to doctors having to many sick computers to deliver proper patient care.

MedStar operates 10 hospitals in Maryland and Washington, including the MedStar Georgetown University Hospital, along with other facilities. It employs 30,000 staff and has 6,000 affiliated physicians.

That's a lot of paralysis.

Monday’s hacking at MedStar came one month after a Los Angeles hospital paid hackers $17,000 to regain control of its computer system, which hackers had seized with ransomware using an infected email attachment.

Hollywood Presbyterian Medical Center, which is owned by CHA Medical Center of South Korea, paid 40 bitcoins — or about $420 per coin of the digital currency — to restore normal operations and disclosed the attack publicly. That hack was first noticed Feb. 5 and operations didn’t fully recover until 10 days later.

Hospitals are considered critical infrastructure, but unless patient data is impacted there is no requirement to disclose such hackings even if operations are disrupted.

I won't even comment on why a US hospital is owned by a Korean medical center.  The statement "unless patient data is impacted there is no requirement to disclose such hackings even if operations are disrupted" implies yet another blind spot in the unregulated health IT industry.  Add that to the blindness towards close-calls and actual harms, and you have a field being pushed on the population under penalty by those somewhat deaf, dumb and blind to the downsides.

Computer security of the hospital industry is generally regarded as poor, and the federal Health and Human Services Department regularly publishes a list of health care providers that have been hacked with patient information stolen. The agency said Monday it was aware of the MedStar incident.

All I can hear is "ka-ching! ka-ching!" as the costs to fix the poor computer security in the hospital industry accrues. 

How much will patient care suffer as a result of the diversion of yet more resources to cybernetics?

As I've written before, stories like this support a serious rethinking of the entire healthcare IT hyper-enthusiast movement to whom the considerable downsides (even patient death) are just an unfortunate "bump in the road" (http://hcrenewal.blogspot.com/2012/03/doctors-and-ehrs-reframing-modernists-v.html), or perhaps more accurately, the healthcare IT hyper-enthusiast religion.

-- SS

[1] I've written that paper for many clinical settings, including highly specialized forms as I implemented highly successfully in invasive cardiology (http://cci.drexel.edu/faculty/ssilverstein/cases/?loc=cases&sloc=Cardiology%20story), needs reconsideration, relieving clinicians of clerical work and employing data entry clerks to enter the data.  This would be supplemented by far less expensive document imaging systems for 24/7 availability, and computerized lab results retrieval - the latter with appropriate humans on the receiving end to prevent the "silent silo" syndrome of lab results returned to a computer silo but missed by clinicians due to being very busy and due to unreliable/fatiguing cybernetic alerting.  A lot of workers can be paid for by saving $50 or $100 million on software.

3/30/2016 Addendum:

This is not the first time for EHR outages at MedStar.

As in my May 16, 2015 post "Another day, another EHR outage: MEDSTAR EHR goes dark for days" at http://hcrenewal.blogspot.com/2015/05/another-day-another-ehr-outage-medstar.html, I cited Politico. 

The doctor's observation I highlighted below is of interest.

4/9/15
http://www.politico.com/morningehealth/0415/morningehealth17818.html

MEDSTAR EHR GOES DARK FOR DAYS: MedStar’s outpatient clinics in the D.C. and Baltimore area lost access to their EHRs Monday and Tuesday when the GE Centricity EHR system crashed. The system went offline for scheduled maintenance on Friday and had come back on Monday when it suffered a “severe” malfunction, according to an email from Medstar management that was shared with Morning eHealth.

“All of a sudden the screens lit up with a giant text warning telling us to log off immediately,” a doctor said. “They kept saying it would be back up in an hour, but when I left work Tuesday night it was still down.”

This doctor told us that the outage was “disruptive and liberating at the same time. I wrote prescriptions on a pad for two days instead of clicking 13 times to send an e-script. And I got to talk to my patients much more than I usually do.

But of course we didn’t have access to any notes or medication history, and that was problematic.” MedStar notified clinicians in the email that any information entered in the EHR after Friday was lost.

-- SS

Baca selengkapnya

Hollywood Presbyterian Medical Center: Negligent hospital IT leaders allow hacker invasion that cripples EHRs, disrupts clinicians ... but patient safety and confidentiality not compromised

Allen Stefanek computer security Hollywood Presbyterian Medical Center medical record confidentiality medical record privacy Patient care has not been compromised

Hollywood Presbyterian Medical Center: Negligent hospital IT leaders allow hacker invasion that cripples EHRs, disrupts clinicians ... but patient safety and confidentiality not compromised

Unknown 2/19/2016 Komentar

To the cybernetic idealists out there who think computers are the greatest thing next to sliced bread in the healthcare environment, I say, pray you are not on the operating table when something like this happens:

Hackers’ Ransom Attack On California Hospital More Proof Healthcare Cybersecurity Is Floundering
International Business Times
Jeff Stone
02/17/16
http://www.ibtimes.com/hackers-ransom-attack-california-hospital-more-proof-healthcare-cybersecurity-2309720

Who would have thought that, for healthcare professionals, performing surgery, working long hours and navigating the dense world of U.S. health law would be easier than protecting hospital computer networks? That, however, appears to be the case after yet another hospital was victimized in a cyberattack. It’s just the latest example of a U.S. medical provider on the wrong end of a digital assault made possible by a lack of security measures.

I, for one, would have thought that.  In fact, I've been writing about these issues for years (see my many posts at query links http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality and http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy).

Doctors at Hollywood Presbyterian Medical Center, in southern California, have been suffering serious computer issues for at least a week, the CEO announced Sunday. Doctors have been unable to digitally access patients’ medical records, staff has been communicating via fax machines and patients have reported long delays in receiving care. It’s all the result of a cyberattack carried out by unknown hackers who are demanding 9,000 bitcoins (roughly $3.4 million) to restore the system to normal.

Ransom for access to EHRs.  The hospital's IT leadership should be held accountable for this invasion of the clinic by cybercriminals.  It's not like the issue is unknown:

... “Hospitals are a veritable bullseye for hackers,” said Grayson Milbourne, security intelligence director at the cybersecurity company Webroot, which works with a number of hospitals and healthcare companies. Milbourne added that the value of patient records is an irresistible target for cybercriminals. “For starters, [hospitals] run on a tight budget and their IT infrastructure is often a very low priority when compared to affording new medical devices and staff. 

More from techtimes.com at http://www.techtimes.com/articles/133874/20160216/hackers-hold-hollywood-hospital-s-computer-system-hostage-demand-3-6-million-as-patients-transferred.htm:

... According to NBC, the damage has caused the hospital to be unable to continue day-to-day operations. To keep up activity at the medical center, the staff has turned to manual documentation using pen and paper to take down patient information and jammed fax lines and telephones to communicate from one department to another. The administration has forbidden the use of other computers for fear that the harmful software could spread to more workstations.  Allen Stefanek, President and CEO of the hospital, says that "significant IT issues" began to emerge last week, leading to a declaration of "internal emergency." He also mentions that the attack was random, not malicious, noting that the emergency rooms have been "sporadically impacted since Friday."

The realities of IT in 2016, when hospitals are increasingly dependent on IT command-and-control systems through which every transaction of care must pass, lead to the conclusion that "IT infrastructure is often a very low priority" reflects negligence.

Back to the IBT article.  The CEO at this hospital proffers the usual BS:

Hollywood Presbyterian’s CEO [Allen Stefanek] told NBC, “Patient privacy has not been compromised."  ...The intrusion  has been described as a ransomware attack, which is typically defined as an attack that involves a hacker infiltrating a victim’s computer, and encrypting their data until the victim agrees to pay a bitcoin ransom. The hospital denies any patient data has been compromised.

Right.  Hackers take control of information systems, but patient data has neither been altered, nor its privacy impaired.

From the second article:

... the patients are not safe from harm. Stefanek insists that the incident has no impact on the overall care for the patients, but some have spoken out to say otherwise. Jackie Mendez and her 87-year-old mother say that they have to drive to Palmdale to pick up medical tests, which takes them over one hour to do so. "It's bad. She's an older person. It's not right she has to do this," she says. Another patient named Belmont West is also affected by the incident. Belmont says he went to the hospital to get his grandmother's medical test results to no avail.

and there's this:

... some patients had to be transferred to other hospitals, as some of the medical equipment that need computers at the Hollywood Presbyterian Medical Center were rendered inoperable, including apparatuses for X-ray and CT scans, documentation and pharmacy and lab work.

These ridiculous executive canned lines, including "the incident has no impact on the overall care for the patients" a.k.a. "patient safety had not been compromised" (see query link http://hcrenewal.blogspot.com/search/label/Patient%20care%20has%20not%20been%20compromised), are increasingly absurd, non-credible, and tiring.

The urgency [for hospitals to meet standards of care for IT security -ed.] is growing. One in three Americans had their health records breached in 2015, according to multiple reports released last month. Many of those records were breached as part of the nation-state hacks on health insurers Anthem and Primera, though experts predict hospitals will become more attractive targets as they begin to rely on insulin pumps, intravenous flows and other machines that are connected to the Internet.

I note that if hospitals cannot afford the required diligence, they need to get out of the IT business.  Paper cannot be hacked or held for ransom en masse.

In the end, the hospital appeased the hackers:

Hospital paid 17K ransom to hackers of its computer network
By ANDREW DALTON
Associated Press
http://bigstory.ap.org/article/d89e63ffea8b46d98583bfe06cf2c5af/hospital-paid-17k-ransom-hackers-its-computer-network
Feb. 17, 2016 11:44 PM EST

LOS ANGELES (AP) — A Los Angeles hospital paid a ransom of about $17,000 to hackers who infiltrated and disabled its computer network because paying was in the best interest of the hospital and the most efficient way to solve the problem, the medical center's chief executive said Wednesday.  Hollywood Presbyterian Medical Center paid the demanded ransom of 40 bitcoins — currently worth $16,664 dollars — after the network infiltration that began Feb. 5, CEO Allen Stefanek said in a statement. ... "The quickest and most efficient way to restore our systems and administrative functions was to pay the ransom and obtain the decryption key," Stefanek said. "In the best interest of restoring normal operations, we did this."

They got off cheap for their negligence, relative to the initial demands.

Questions remain, however:

• Was any patient data altered or corrupted, either deliberately or as a result of the hack?
• Was any patient data copied or stolen?
• Was any malicious code left behind by the hackers on any computer on the network, e.g., "back doors" or other malware that could cause future problems?  Put another way, after paying the ransom, does the hospital believe it is dealing with 'honorable criminals'?
• One might presume the hospital, in an abundance of caution, is now paying after-the-fact for the expertise required to fully assure the integrity of its networks, computers and EHR and other business systems, but is this truly the case?
• Were any patients harmed as a result of the disruptions to information flows, and of so, are the IT leaders in part liable? 
• Will any patients suffer harm moving forward as a result of lost computer information during the episode, incomplete backloads of data on the paper that was resorted to during the crisis, or other factors?  Medical errors due to lost data can propagate forward in time, as I can attest to both personally and professionally.

It is my belief that, until and unless hospital leadership is held fully accountable for incidents such as this, such incidents will be one of many more moving forward.

Incidents like this are made more tragic by the increasing evidence that the benefits from healthcare cybernetics are not exactly what the zealots, pundits and industry opportunists advertised.

-- SS

Baca selengkapnya

Who Benefits? - Despite Data Breaches, Staff Cuts, Vulnerable Patients' Coverage Cuts, Transplant Program Probation, Multi-Million Dollar Executive Compensation Persists at UPMC

executive compensation hospital systems legal misconduct medical record confidentiality mission-hostile management UPMC

Who Benefits? - Despite Data Breaches, Staff Cuts, Vulnerable Patients' Coverage Cuts, Transplant Program Probation, Multi-Million Dollar Executive Compensation Persists at UPMC

Unknown 6/10/2015 Komentar

There are so many things wrong with US and global health care that it is easy to get lost in the details, and despair of finding solutions.  Keep in mind, however, that the intractability of many of the problems may be quite man made.  Many problems may persist because the status quo is so beneficial to some people.

The Current Troubles at UPMC

Consider, for example, the troubles that have recently plagued UPMC, the giant health care system in western Pennsylvania.  In the last month, the following reports have appeared.

Electronic Data Breach Affected 2200 Patients

On May 15, the Pittsburgh Tribune-Review reported,

Personal data may have been stolen from more than 2,000 UPMC patients by an employee of an outside company the hospital giant used to handle emergency room billing, the latest in a string of data thefts to hit Pittsburgh health companies.

Note that this was only the most recent data breach at UPMC,

 UPMC was the victim of a data breach last year in which Social Security numbers and other sensitive data from all 62,000 UPMC employees were stolen when thieves hacked into an employee database at the health system.

The confidentiality of patient records is a  major responsibility of health care professionals and hospitals.  Yet UPMC does not seem to be doing a good job in protecting such confidentiality.

UPMC Move to Cut 182,000 "Vulnerable" Elderly Patients from it Medicare Advantage Plan Challenged in Court

The Pittsburgh Business Times reported on May 21,

Health system UPMC will defend its decision to cut 182,000 seniors from its provider network at a Commonwealth Court hearing May 27 in Harrisburg.

The hearing will determine whether UPMC complied with a consent decree that was reached last year and intended to protect 'vulnerable' populations from fallout of the messy Highmark-UPMC divorce. The seniors have Medicare Advantage coverage through UPMC rival Highmark Inc., and most commercial contract relations between the two health care titans ended Dec. 31.

This doesn't sound like the "patient-centered" care UPMC boasts about on its website.

UPMC to Cut 3,500 Staff Via Buyouts

Modern Healthcare reported on May 26,

In Pittsburgh's fiercely competitive healthcare market, UPMC announced voluntary buyouts to reduce its labor costs.

The system—which has also cut its hospital capacity in recent months—offered 3,500 workers voluntary buyouts to 'achieve cost-savings for UPMC by adjusting our workforce to meet the demands of the healthcare marketplace,' said spokeswoman Gloria Kreps.

Not mentioned by UPMC spokespeople were the possible effects on patient care of cutting about 5% of the most experienced members of the UPMC workforce.

UPMC Attorneys Disqualified from Defense of Wrongful Death Case

The Pittsburgh Post-Gazette reported on May 30,

The law firm that represents UPMC in many civil matter was disqualified from a medical malpractice cast this week after a judge found that an attorney from Dickie, McCarney & Chilcote improperly spoke with and advised a witness.

This does not say a lot for how UPMC managers pick legal counsel and manage their seemingly many legal defenses.

UPMC Lung Transplant Program on Probation, Again

On June 2, the Tribune-Review reported,

A national organ-sharing group has put UPMC's lung transplant program on probation for a year, listing concerns about how the program handled donated organs. 

The United Network for Organ Sharing cited 14 cases in 2013 and 2014 when the hospital system accepted lungs that UPMC doctors later found could not be transplanted in intended recipients, said Dr. Jonathan D'Cunha, UPMC's lung transplantation surgical director.

UPMC kept the organs for other patients in UPMC Presbyterian in Oakland, an approach approved by regional organ procurement groups that supplied the lungs, D'Cunha said. But UNOS, a nonprofit that manages the American organ transplant system, objected to what it called 'an unusually high number of instances' of the practice.

Probation ordered by the board of UNOS and the Organ Procurement and Transplantation Network took effect Monday, according to UNOS.

D'Cunha said the transplant program remains fully operational but will be operating under a corrective-action plan.

This was not the first trouble that a UPMC transplant program has encountered.  As the Pittsburgh Post-Gazette reported,

This is  the second time UPMC has been placed on probation for a transplant problem.

In 2011, it was placed on probation ... after disease was transferred from a living kidney donor to a recipient.

Note that while the first instance of probation seemed to suggest competency issues, the latest one seems to be about ethical issues.  By transplanting kidneys into immediately available UPMC patients who may have lower priorities than other patients on the list, UPMC may be disfavoring patients from "outside," whose transplants, incidentally, would not generate much revenue for UPMC.

An editorial in the Post-Gazette suggested while UPMC "pleads ignorance" about these rules, "Western Pennsylvania's largest hospital network should have known better."

Just Another Bad Month?

Thus it was just another bad month at the office for UPMC management.  But UPMC management has had lots of bad months.  For example, since 2011, we have previously discussed
-  Fantastical musing by the UPMC CEO about health care run by computers, not doctors (look here)
-  Fantastical claims by UPMC in response to a lawsuit that is has no employees (look here)
-  Numerous malpractice cases filed against UPMC related to problems with its electronic medical records (look here, here, here, here)
-  Layoffs at UPMC due to problems with its electronic medical records (look here)
-  A lawsuit by the Mayor of Pittsburgh claiming UPMC should be stripped of its non-profit status (look here).  

The $6.4 Million CEO, and the Other Million Dollar Managers

One would think that these series of events, all in a short time, coupled with all these previous stories, might raise questions about who is running the institution, and what they are being paid.


Instead, however, the Pittsburgh Tribune-Review published a story on May 15, 2015, about just how well paid top UPMC managers continue to be.

UPMC's Jeffrey Romoff banked total compensation of $6.4 million two years ago, ranking the chief executive's pay among the nation's highest for nonprofit health leaders.

The 69-year-old Romoff was one of 31 employees of Western Pennsylvania's largest integrated health system to be paid more than $1 million in 2013,...

Romoff's 2013 pay, which included a base salary of nearly $1 million plus $5 million in incentives and deferred income, was down 3 percent from the previous year but well above the median compensation for a nonprofit hospital CEO.

The defense of Mr Romoff's compensation followed the same pattern we have discussed repeatedly. Justifications for exceedingly generous compensation for health care managers, particularly of non-profit hospital, often are superficial, limited to talking points we have repeatedly discussed, (first  here, with additional examples of their use here, here here, here, here, here, here, and here.)  These are:
- We have to pay competitive rates
  We have to pay enough to retain at least competent executives, given how hard it is to be an executive
- Our executives are not merely competitive, but brilliant (and have to be to do such a difficult job).

So,

UPMC spokeswoman Susan Manko wrote in an email that compensation for the company's executives is tied to performance that is based on 'clearly defined goals, including quality of care, community benefit, financial measures and other key factors.'  Pay takes into consideration what other industry executives are making, she noted.

Thus,, by inference, she implied Mr Romoff's brilliance in meeting the "clearly defined goals," and overtly stressed the competitive rates talking point.

However, the clearly defined goals including putting the transplant on probation twice, having several electronic data breaches, trying to discharge the most experienced employees, being sued for being a non-profit in name only, being subject to numerous malpractice suits, and having one law firm used to defend one of these suits disqualified,  and dumping hundreds of thousands of elderly, "vulnerable" patients?  Really?

A fair comparison was to other overpaid managers, not to the dedicated health care professionals who make the system work?  Really?

Also, as the Pittsburgh-Tribune Review reported on February, 2015, the Chairman of the Board of UPMC, Nicholas Beckwith, thinks Mr Romoff is a

brilliant leader and stood by the board's decision to pay Romoff $6.6 million a year, among the highest CEO salaries for nonprofits in the region.

Furthermore,

'When people ask me about his pay, I say, ‘What would you pay him?'' Beckwith said. 'If they're going to understand the brilliance of Jeffrey Romoff, they have to acknowledge there's no more effective leader in the nation than Jeff Romoff.'

So here was the "brilliance" talking point really writ large.  The most effective leader in the entire US?  Really?

At best, Mr Beckwith seemed to be only thinking about the financial performance of UPMC, rather than its clinical performance, its ethical performance or its effects on patients and their outcomes. But then again, Mr Beckwith might not know much about that,

Beckwith worked as a salesman for Murrysville-based Beckwith Machinery and eventually became its CEO.

But one letter to the Pittsburgh Tribune-Review did suggest

Perhaps UPMC should consider offering buyouts to that group of egotists who inhabit the upper reaches of the U.S. Steel Tower. Then they could move to the next phase of life — old and wealthy.

Summary

So we have presented the recent unpleasantness at UPMC as emblematic of some of the types of unpleasantness that afflict US (and global) health care, including threats to patients' confidentiality and access, problems with quality of health care, possible ethical misconduct, ill treatment of experienced health care staff, etc.  Yet consider that despite these multiple failings, and a history of similar failings going back years, the top hired managers of the non-profit hospital health care system are being made millionaires many times over.  They clearly are benefiting greatly from the current system, regardless of whether the system benefits others.  In fact, one begins to wonder if they are paid well despite the current problems, or because of them?

So one lesson is: every time some new version of health care dysfunction appears in public, think not only about its bad effects on patients, professional values, the public, etc.  Think about who is gaining from the current bad status quo.

 For a slightly more specific lesson....  In a 2014 interview, corporate governance experts Robert Monks and Nell Minow, Monks said,

Chief executive officers' pay is both the symptom and the disease.

Also,

CEO pay is the thermometer. If you have a situation in which, essentially, people pay themselves without reference to history or the value added or to any objective criteria, you have corroboration of... We haven't fundamentally made progress about management being accountable.

The symptom and the disease have metastasized to health care, from huge for-profit corporations now also to even small non-profit hospitals.   Thus, like hired managers in the larger economy, health care managers have become "value extractors."  The opportunity to extract value has become a major driver of managerial decision making.  And this decision making is probably the major reason our health care system is so expensive and inaccessible, and why it provides such mediocre care for so much money. 

One wonders how long the people who actually do the work in health care will suffer the value extraction to continue?
As we have said far too many times - without much impact so far, unfortunately - true health care reform would put in place leadership that understands the health care context, upholds health care professionals' values, and puts patients' and the public's health ahead of extraneous, particularly short-term financial concerns. We need health care governance that holds health care leaders accountable, and ensures their transparency, integrity and honesty.

But this sort of reform would challenge the interests of managers who are getting very rich off the current system.

As Robert Monks also said in the 2014 interview,

People with power are very reluctant to give it up. While all of us recognize the problem, those with the power to change it like things the way they are.

So I am afraid the US may end up going far down this final common pathway before enough people manifest enough strength to make real changes. 

ADDENDUM (16 June, 2015) - This post was re-posted on OpEdNews.com. 

Baca selengkapnya