IOM: Health IT Needs Better Oversight

Although health information technology (IT) has already gained a foothold in some hospitals and physician offices, little evidence has been produced to date demonstrating that it actually achieves proponents’ claim that using it improves patient safety. Even more concerning, skeptics say that health IT systems can compromise patient safety.

Now, in a report issued on November 8 that evaluates the current state of patient safety and health IT, the Institute of Medicine (IOM) is calling for increased federal scrutiny of health IT safety (http://tinyurl.com/cc6jfma).

In its 1999 landmark report, To Err Is Human: Building a Safer Health System, the IOM estimated that medical errors in US hospitals resulted in up to 98 000 annual deaths. Passage in 2009 of the Recovery Act, which commits $32 billion to implementing health IT systems in the care setting, served as the stimulus for creation of the new IOM report, Health IT and Patient Safety: Building Safer Systems for Better Care, said Paul C. Tang, MD, MS, a member of the IOM writing committee and vice president and chief innovation and technology officer, Palo Alto Medical Foundation in California.

There are many reasons to have health data in an electronic format, Tang noted. “As a country, we are thinking about the new ways of managing patient populations, really understanding quality of care. Thinking broadly, the health care community thinks health IT systems are some of the tools we need to deliver safer and better care,” he explained.

But Richard I. Cook, MD, another member of the IOM writing committee and an associate professor of anesthesia and critical care at the University of Chicago, is skeptical that the claims of improved safety from health IT are legitimate at this time. “It is clear that the people proposing these health IT systems had expectations that they would perform in ways that were unrealistic and ill-advised,” Cook said. “The problem is that health IT systems do not appear to improve safety in any significant fashion, and it is becoming clearer that they actually cause different types of harm.”

The committee calls for the secretary of the Department of Health and Human Services (DHHS) to monitor and publicly report on the progress of health IT safety annually. But it stopped short of recommending that the US Food and Drug Administration (FDA) regulate such systems because rigorous FDA oversight could potentially stifle innovation. However, it also said that if progress toward safety and reliability is not sufficient, the DHHS secretary should direct the FDA to regulate health IT. That recommendation also calls on the secretary to immediately direct the FDA to begin developing the necessary framework for regulation so that it is ready to be used if and when the secretary decides it is needed.

Cook, however, said that the FDA should regulate health IT as class III (high-risk) medical devices, and he issued a dissent to the IOM report's recommendation. “The extent of the injuries generated by health IT is unknown because no one has bothered to look for them in a systematic fashion. Indeed, the failure to treat health IT as a medical device has played a significant role in keeping the problems with health IT from becoming known. Medical device manufacturers are obligated to report instances of patient harm connected to their devices. Health IT vendors are not,” Cook wrote.

A key element of the IOM report is its call for disclosure of adverse events. The report noted that currently there are several impediments blocking the free flow of information, such as nondisclosure clauses in contracts between health care systems and health IT vendors. The report recommended that the DHHS secretary ensure that health IT vendors support the free exchange of information and not prohibit the sharing of such information.

Specifically, the report calls for the DHHS secretary to establish a mechanism for both vendors and users to report health IT–related deaths, serious injuries, and unsafe conditions. The report said such reporting should be mandatory for vendors and voluntary, confidential, and nonpunitive for users.

In addition, the writing committee concluded that an independent federal entity similar to the National Transportation Safety Board should be established to investigate patient deaths, injuries, and unsafe conditions associated with health IT, said Tang. This entity would make nonbinding recommendations to the DHHS secretary.