View source for Vendor Selection Criteria: IT and technical requirements


== IT and Technical Requirements ==

* For already existing software functionality, does the vendor employ reliable and trustworthy software like an open-source MySQL or Apache server? Or do they develop their own system, or do we have to license a proprietary one (extra cost)?
* How the vendor estimates the total amount of users and licenses needed? Will they be concurrent user licenses or asynchronic?
* Will technical support remain active even if the Hospital is running a non-upgraded system? For how long?
* Does the system use [http://medical.nema.org/ DICOM] standards for the transmission of image data?
* Does the system provide an imaging database or allow customized program attachments of imaging needs of specific departments in the hospital?
* What are the hardware requirements?
* How frequently does the vendor provide patch upgrades for the product?
*Do the upgrades come with a fee?
*Is the vendor’s application (system) platform independent? 
*Is the system using standards such as Snomed, [http://www.who.int/classifications/icd/en/ ICD 10]; [http://hl7book.net/index.php?title=HL7_version_2 HL7 Version 2] or [http://hl7book.net/index.php?title=HL7_version_3 3]; HL7 infobutton…)
*How does the system handle multiple logins of the same user at different locations/instances?
*How does the system handle user inactivity? (auto-logout, discarding\saving changes, draft creation)
* Is the software capable of using biometric data for rapid login by providers who are mobile between patients/sites?
* How does the system lend itself to automated back-ups? Does the vendor provide IT support team to implement specific back-up plans that will work with the hospital's IT team? 
* Can the system allow login remotely – off site transcription or home or other clinic?
* Does the system provide the ability to identify all users who have accessed an individual's chart over a given time period, including date and time of access?
* Does the vendor offer a Software as a Service (SaaS) solution, also know as an Application Service Provider (ASP), or a client-server solution?
* With existing systems, how tightly integrated will the new EHR system be and what prep work is required to make the integration possible?
* Does the system have modules for automatic update of knowledge sets at regular intervals, more like automatic update of antivirus definitions?
* How often does the software need to be upgraded?
* Does the vendor have a mechanism or protocol to ensure post implementation upgrades and updates won’t disrupt workflow, after the system has gone live?
* Can the vendor provide capabilities to test and validate upgrades and updates to the system in an environment that that mimics the production environment before they are pushed to production; post implementation?
* Is the system designed to ensure a point of failure in one component of the system won’t take down the full system.
* Does the software allow generation of customized reports such that desired information can be extracted periodically for performance improvement projects or performance monitoring.
* Does the vendor utilize the desired technology?
* Is remote access available for mobile devices?
** Is this web-access or a dedicated app?
** In what way is this mobile access limited?  Does it have access to all functionality?
** What devices can access the mobile apps? (e.g. iPad, iPhone, Android, etc.)
* Is remote access cross platform? The use of open standards (e.g. HTML5, [[Extensible Markup Language (XML)|XML)]] allows users on any platform, including smartphones and tablets, to have equivocal access to the system.
* Does the system support web-based working environment?
* If web based application, does it require a specific browser or versioning of web access?
* Does the system provide extension package or software for IT engineers or users? 
* Does the system comply with HIMMS standard?
* Can the system be installed on Windows or IOS operating systems?
* How does the system’s IT infrastructure requirement align with the institution’s current infrastructure and the institution’s infrastructure five-year strategic road map?
* What hardware technology (Server) does the database support? And does the supported hardware provide built-in high availability?
* Does the system’s application (not database) support virtual environments? Will it run on a virtual server? 
* Is your ticketing system capable of interfacing with [name of ITSM software utilized by your institution]?
* Negotiate the terms and prices of the interface system: to/from PM system, scanner, fax machine, laboratory, health information exchange partners such as hospitals, ambulatory surgical centers, radiology, ePrescribing.
* Can the system be hosted and supported remotely by the vendor?   
* How scalable is the IT infrastructure?  Is there a peak limit on the number of concurrent users utilizing the system?  (this comes in handy during mergers & acquisitions in which you may exponentially increase in size of user base) 
* Does the system support dictation function?
* Does the system support speech recognition?
* Does the system have a spell check tool for notes (progress notes, letters, and H&P notes)? 
* What are the data back up options available in case of natural calamity? 
* Is the EHR system compatible with other systems in the event of termination or vendor's insolvency? <ref name="obsolete technology">Neal, D. (2011). Choosing an Electronic Health Records System: Professional Liability Considerations. Innovations in Clinical Neuroscience, 8(6), pg. 45.</ref>
* Are scanning capabilities available and if so, is there a particular scanner make and model required?
* Are scanning licenses needed? How much are the scanning licenses and are they needed per user or per pc?
* Is interface with Hospital ADT system possible?
* Does the system offer Enterprise Master Patient Index functionality?

=== Hospital IT Adoption Strategies ===

In order to meet the governments standards for "meaningful use,"  hospitals have adopted one of three strategies to help select the electronic health record (EHR) system that is best suited for their organization.

# '''Single-Vendor Strategy'''
#* Enterprise resource planning (ERP) software systems are being produced by vendors to integrate multiple applications on a single platform.  This is known as a single-vendor strategy (SVS).  These EHR systems include both administrative and clinical applications.  They also allow data access over different locations.  Systems such as these allow for a very efficient implementation process and have strong administrative features geared towards corporate decision making.
# '''Best of Breed Strategy'''
#* The best of breed strategy allows health care entities to avoid the re-engineering of their entire IT system.  By integrating select components of multiple vendor's software applications, the best of breed approach is able to keep the enterprise system aligned with a facility's goals for both quality and organizational capacity.  This type of EHR implementation also permits incremental application of the different components which can assist with the budgeting demands of a facility.
# '''Best of Suite Strategy'''
#* The best of suite strategy allows hospitals to build their EHR infrastructure upon a base application.  An example of this would be using a vendor's application system based on coding claims as the facility's foundation software.  The relational database of this system would then allow for other components to be integrated with its framework.  Having a core application suite in place allows for less workflow disturbance associated with EHR implementation.  This system strategy permits a facility to keep many of their original applications and integrate them into the core software application.  The total cost of ownership (TCO) is thought to be lower with the BOS strategy than with either the BOB or the SVS.

Hospitals choosing the BOS strategy have a larger percentage of their complete EHR implemented, due to their using legacy applications which are already in place.  Eric Ford, et al, write that the most common form of EHR implementation among hospitals is the SVS strategy. <ref name="Ford 2010">Ford, E., Menachemi, N., Huerta, T.R., Yu, F.(2010). Hospital IT Adoption Strategies Associated with Implementation Success: Implications for Achieving Meaningful Use. Journal of Healthcare Management; 55(3): 175. http://go.galegroup.com.ezproxyhost.library.tmc.edu/ps/i.do?p=HRCA&u=txshracd2509&id=GALE|A228331002&v=2.1&it=r&sid=summon&userGroup=txshracd2509&authCount=1</ref>

=== Remote vs Local Hosting ===
* Some vendors offer remote hosting services for an additional recurring fee.  This fee may vary with number of concurrent users, functionality, and resources such as storage space allocated to the client.
* Advantages to being remote hosted include reduced need for on site hardware and upgrades to that hardware, 24/7 tech support from vendor, Secure and nearly disaster proof redundancy and back-ups, and enhanced support for upgrades.
* Locally hosted systems require the client to purchase and maintain hardware on-site. There are many [http://www.kevinmd.com/blog/2011/05/pros-cons-cloud-based-web-based-emr-systems.html|  Pros and cons of web based EMRs] but the decision should usually be based on what the client is prepared to devote to maintaining servers and network environment.

=== Legacy systems ===

* How does the vendor compare in [http://www.klasresearch.com/ KLAS] rankings of similar systems and applications?
* How will legacy patient record data be integrated into the new system?
* Does the vendor provide services to convert and transfer data from legacy systems into the new system, and if so, what is the cost?<ref name="himss-ama-legacy">http://www.himss.org/files/HIMSSorg/content/files/Code%2093_15%20questions%20to%20ask%20before%20signing%20an%20EMR-EHR%20agreement_AMA.pdf</ref>
* How does a legacy Practice Management System integrate with the EHR system? Is there a list of successful PM vendor integrations? 
*Make sure the vendors give accurate information for the Request for Proposal. So the stakeholders can make informed decisions on the comparison of vendors.
-Zoker 9/17/2011
* What is the legacy Practice Management System conversion process for legacy data import into the EHR system? Time/cost and loose-ends? What reference clients are there for particular legacy PM systems?
* Does the vendor have a List of Lessons Learned from previous implementations?
* Does the vendor have a legal license to essential code sets, such as the [http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/cpt.page? AMA Current Procedural Terminology] (CPT®) file? Will the vendor maintain this license annually as part of your service or maintenance agreement?[http://www.ama-assn.org American Medical Association]
* How does the vendor manage diagnosis documentation and coding? Does the system require specific coding terminology or does it allow provider synonyms for coding terms?  How is that updated and maintained? 
* Does the vendor offer a “test environment” in which upgrades are loaded to allow you time to test and learn their functionality without affecting your live system? [http://www.ama-assn.org American Medical Association]
* What is the vendor's rate for on time & under budget implementations?
* Are other consulting firms certified to implent the vendor's product? If so will the vendor provide system updates and customer service if system issues (not related to implementation) arise?
* Check whether the vendors EMR products are certified Health IT products through the [http://oncchpl.force.com/ehrcert/ehrproductsearch  Office of the National Coordinator (ONC) for HIT.] Previously [http://www.cchit.org/ CCHIT] provided a list of certified EMR but as of late 2014 is no longer in operation.
* What services does the EHR vendor offers for post-implementation optimization of the system with respect to training and system customization? 
* What is the company policy regarding data ownership for the ASP EHR? 
* The EHR product should be certified for the standards and certification criteria issued by the Office of the National Coordinator for Health Information Technology (ONC-HIT)? How many criteria does it satisfy?
* How is documentation managed and preserved over time? How is documentation protected from being altered, in all parts of the system including the underlying databases?<ref name="Legal EHR">The Legal Electronic Health Record.www.himss.org/files/HIMSSorg/content/files/LegalEMR_Flyer3.pdf</ref>
*Does the vendor retain, ensure availability, and destroy health record information according to organizational standards? For instance, retaining all EHR data and clinical documents for the time period designated by policy or legal requirement; retaining inbound documents as originally received (unaltered); ensuring availability of information for the legally prescribed period of time; and provide the ability to destroy EHR data/records in a systematic way according to policy and after the legally prescribed retention period.<ref name="EHR Functions">Understanding Features & Functions of an EHR.http://www.aafp.org/practice-management/health-it/product/features-functions.html</ref>

=== Troubleshooting ===

* Immediate trouble shooting ability
* Once the problem is identified, the first step is to ascertain the scope<ref name="Kevin MD"></ref>
* If the scope of outage is large and the root cause is unknown, raise alarm bells early<ref name="Kevin MD"></ref>
* Bring visibility to the process by having hourly updates,and multiple eyes on the problem<ref name="Kevin MD"></ref>
* Over communicate with the users<ref name="Kevin MD">http://www.kevinmd.com/blog/2010/09/10-tips-troubleshooting-complex-ehr-infrastructure-problems.html</ref>
* Do not let pride get in the way<ref name="Kevin MD"></ref>
* It is important to set deadlines in the response plan<ref name="Kevin MD"></ref>
* The simplest explanation is usually the correct one<ref name="Kevin MD"></ref>
* Regular connect with customers about their problems
* The system shall include documentation that describes the patch (hot-fix) handling process the vendor will use for EHR, operating system and underlying tools (e.g. a specific web site for notification of new patches, an approved patch list, special instructions for installation, and post-installation test).
* The system shall include documented procedures for product installation, start-up and/or connection.
* What options does the EMR have for upfront abstraction and scanning? Are these costs included in the purchase of the EMR?
* Can the vendor support the organization desired implementation strategy?
* How can the [http://en.wikipedia.org/wiki/Electronic_health_record#Quality quality of EHR] technology be useful for electronic exchange of clinical health information among providers and patient authorized entities?

=== EHR Disaster Recovery ===

Either internal hardware problems or external sources (especially in EHR systems that store data in the cloud) may cause unexpected EHR system failures.  The EHR may be unavailable for a few hours or for a week or more. Disaster recovery must always be considered when selecting a vendor to ensure that data is secure in these [[Contingency_planning_for_electronic_health_record-based_care_continuity:_a_survey_of_recommended_practices| emergency situations]]. Questions to consider include:
 
* Does the EHR use internal hosting or an ASP model?  <ref name="himssdisaster">EHR and Disaster Recovery. http://www.himss.org/News/NewsDetail.aspx?ItemNumber=6469</ref>
* Is the EHR system adherent to the HIPAA Security Rule and provides both a contingency plan and secure data back-up reserves in case of system failure? 
* Has the EHR provided users with a detailed disaster plan during implementation of the EHR that includes how to cope with unexpected system failure?
* Has the EHR provided training packets and educational materials for end users to study to prepare for unscheduled downtime of the EHR?
* Will the EHR notify users immediately when system failure occurs and provide information about the breadth of the failure and the time anticipated before the EHR will be restored?
* What happens when small private EHR vendors go out of business for any reason? Will you have a backup of the source code when that happens? Are we able to access that source code for our use?
* Is off-site back-up and recovery supported in the event of a natural disaster or other catastrophic event?
* Is training available for catastrophic event recovery?
* What safeguards does the software have to warn users/administrator of an impending major failure?
* Does the software monitor the hardware that it runs on? 
* Is there a technical relationship between the EHR/EMR vendor and hardware vendors?
* What are the options to accessing historical data during downtime? Does the vendor provide a web-based interface to accessing read-only data (ensure continuity of care) during downtime?

Some of the criteria I will like to see in an EHR system in the event that it crashes or during downtime*****

1. What backup system does it have in place during such an event so that patient care continues without reverting to a paper system? 

2. How is data updated into the system when it is back up and running again?

3. Where is the data stored so that in the event of a catastrophic crash historical data is not lost?

=== Health information exchange, connectivity, and standards ===
Because healthcare providers rarely use the same EHR system integration between providers in a state or region is being addressed by healthcare information exchange (HIEs). Patients will often see different providers from different groups. An exchange that provides one of more standards methods for integrating with it means that a provider needs to integrate just once, to the exchange, rather than dozens of times.<ref name="Healthcare Electronic REcords TEchnology and Government Funding">Healthcare Electronic Records Technology and Government Funding:Improving Patient Care.http://www.myemrstimulus.com/tag/ehr-application/</ref>

* Does it meet the following connectivity standards: [[HL7]], HL7 CDA, CCR, HL7 CCD, ELINCS and Vendor software specifications? <ref name="whitepaper emr connectivity">What is Your EHR Connectivity Strategy? http://www.corepointhealth.com/sites/default/files/whitepapers/emr-connectivity-strategy-healthcare-interoperability.pdf </ref>
* How flexible is there connection framework?  Can it negotiate multiple standards?
* How quickly can you build and implement an interface within the interface engine?
* Can our facility support the space needed for the installation and implementation of an EHR? 
* Make sure wireless connection is accessible in all parts of the hospital is your facility is planning to use portable devices (tablets, computers on wheels, etc.) to access the system.
* Is there a cost to connecting the EMR/EHR to an HIE? <ref name="HIE"> How to implement EHRs? http://www.healthit.gov/providers-professionals/ehr-implementation-steps/step-3-select-or-upgrade-certified-ehr</ref>
* Does the vendor meet the certification requirements to allow patient data to go from different EHRs to meet Meaningful Use? <ref name= "Health Information Exchange"> How to connect Health Information Exchange (HIE) with Electronic Medical Records.http://www.practicefusion.com/blog/how-to-connect-health-information/</ref>
* Does the system support C-CDA?  Can the system accept, parse, and integrate a CDA document as well as create and export a CDA document as specified in C-CDA?

[[Findings from the SMART C-CDA Collaborative]]

=== Mobile Devices ===
One of the most logical reasons to have an EHR System linked up to a mobile device, such as a cell phone, is for the convenience aspect. “According to a 2012 Vitera Healthcare survey, a reported 91 percent of physicians are interested in a mobile EHR access, along with 66 percent of practice administrators.” <ref name="Mobile EHR Access">Mobile EHR Access http://www.hitechanswers.net/mobile-ehr-access-healthcares-next-big-thing/</ref>

One important consideration is not just the ability to launch the system from a mobile device, but is the EMR optimized for the mobile platform?  Without being optimized, the small screen and touch-driven interface of most mobile devices will not provide the end users a satisfying experience.  If so, does that require purchasing additional applications?  

Advantages: <ref name="Mobile EHR Access"></ref>
* Accessibility is the greatest advantage derived from being able to view patient data. A physician can view necessary patient records whether he/she is at the clinic or at home.
* Clinical documents can be virtually updated from anywhere, speeding up the healthcare process. Medical personnel will be able to avoid the necessity of having to fax or scan documents.
* Patient perception of a physician speaking to him/her from a desktop has been identified as negative. With a mobile device, this barrier is dropped and the patient can feel more in control speaking face-to-face and viewing results on a screen.
* The small size of a cell phone enables a physician or home health worker to avoid the bulkiness of carrying a tablet. The only necessary tool when walking into a consultation will be the mobile device. Hand written notes and large electronic devices will be a thing of the past.

Disadvantages: <ref name="Mobile EHR Access"></ref>
* Sensitive nature of Patient Health Information
* Providers will have to look into providing Mobile Device Management (MDM) in order to have data stored safely.
* Lost or stolen devices will need to have the ability of having information completely wiped from a remote location
* The durability of a mobile device is a concern for hospitals and clinics if they are going to issue out devices to employees. Many mobile devices are very fragile and tend to have an average life span of 2-3 years.

=== Hardware ===
Most physician practices will need to upgrade existing hardware (computers and servers) in order to run the EHR. Typically the vendor will give the organization a “shopping list” for hardware so that the organization will purchase equipment that is compatible with the EHR. <ref name="Selecting a vendor">HEY, WHO DID THIS?Note: there needs to be something here</ref>
*Will the new hardware include tablets, laptops, desktops, servers, routers, printers, and scanners? <ref name=”hadware”> How do I plan for hardware purchases? http://www.healthit.gov/providers-professionals/faqs/EHR-infrastructure-investment. </ref>

==== Desktops ====
Advantages:<ref name="Hardware">www.aafp.org/practice-management/health-it/product/hardware.html</ref>
* Desktops are low-cost and available from a wide variety of vendors.
* Because desktop PCs are standardized, it is relatively easy and inexpensive to find spare parts and support, or to replace a machine.
* Desktops will run just about any software you need.
* Additional devices such as microphones, speakers, and headsets are readily available at low cost.
* The desktop computers can be placed on mobile carts providing the functionality of laptops while keeping the advantages of desktop computers.

Disadvantages:<ref name="Hardware"></ref>
* Because it's stationary, you need to buy a desktop PC for each room in which you need access to your EHR software.
* Desktops typically take up more space than a laptop or tablet PC. While flat screen monitors and tower units save actual desktop space, the standard desktop computer requires more room than either a laptop or tablet PC.
* You must purchase additional equipment to take full advantage of voice recognition and/or handwriting recognition programs.
* In the hospital setting clinical staff needs to access the patient information at the point of care at the bedside. It is impractical to have a computer in each patient room as this not only increases the cost of acquisition of hardware but also increase the cost of maintenance.

==== Laptops ====

Advantages:<ref name="Hardware"></ref>
* A laptop has a smaller footprint and can easily be turned to allow patients to view information on the screen.
* A laptop is less obtrusive during patient interviews.
* Most have fairly long battery life and/or an A/C adaptor.
* Laptops use standard PC inputs such as keyboard and mouse and/or touchpad.
* In the inpatient setting laptops allows one to move from one floor to the other without having to logoff and log on from multiple computers.

Disadvantages:<ref name="Hardware"></ref>
* Although laptops are portable, they can be heavy to carry, typically weighing five to eight pounds.
* Repairs and maintenance tend to be more expensive because laptops use non-standard or proprietary parts. You may have to send a laptop off-site for diagnosis and repair.

==== Tablet PCs ====

Advantages:<ref name="Hardware"></ref>
* Tablets are truly portable and lightweight, typically weighing three to four pounds.
* It may be as powerful as a PC, but it doesn't require a keyboard. Instead, you add information by writing on the screen with a digital pen or stylus, much like you do in a paper chart.
* Handwriting recognition software developed for tablet PCs is getting better, even for very poor handwriting.
* Tablet PCs have integrated dictation capability with voice recognition software that transcribes directly into the patient record.
Disadvantages:<ref name="Hardware"></ref>
* Writing with a stylus takes getting used to; there is a longer learning curve in adapting to a new way of using a computer.
* Handwriting recognition dictionaries have not yet fully integrated medical terminology and acronyms, requiring more correction.
* There is not as much standardized software yet available for tablets.
* Screens are easily scratched and can become unusable without screen protectors purchased at additional cost.
* Some EHRs/EMRs require a higher/lower resolution than others and won't work on a tablet. ex: Amazing Charts (AC) will not work on the Surface Pro 2 but will work on a Surface Pro 3.
* Some EHRs/EMRs can work on a tablet but licenses/support will cost more. ex: To use Amazing Charts on an iPad will require the clinic to purchase their "Cloud Based" package. It is slightly more expensive since AC will host the data vs hosting the EMR on a server built by the clinic or hospital. Amazing charts charges $39 a month in addition to license and support fees, per user for their "cloud." When a clinic or hospital hosts AC on their own server, they only pay the license and annual support fees. <ref name="AC">No Servers to set up. No software to install. http://amazingcharts.com/products/web-based-ehr/</ref>
* In the inpatient setting there may not be a place to put down a tablet safely while examining the patient.
* There is more risk of tablets getting broken due to fall and other accidents.
* While tablets may be better in entering structured data, it may be difficult to enter unstructured data on the tablets.

==== Hybrid/Convertible Laptops ====

Advantages:
*Very lightweight, can be "flipped" from tablet to laptop mode in seconds. 
*Allows for rapid touch-based entry into templated systems for structured data, while maintaining integrated keyboard for rapid entry of unstructured data and normal laptop capability. 
*8+ hour battery life on 4th/5th generation Intel processors

Disadvantages:
*Durability concerns with detachable or re-configurable screen attachment.
*Intrinsic compromise -- will never be quite as good a laptop as a dedicated laptop; not as good a tablet as a dedicated tablet. 
*Have to run full laptop equivalent software, demands on light, power-efficient components may slow real-time performance.

==== Single Sign-On Access ====

One of the physician's concerns is the amount of times they will have to spend log-in and log-out to a computer each time they visit a patient in different sections of the hospital.
It is important to address the following with vendor:
*Security requirements
*Compliance with regulatory requirements for individual accountability <ref name="SSO">Tensions of network security and collaborative work practice: Understanding a single sign-on deployment in a regional hospital
Rosa R. Heckle, , Wayne G. Lutters http://www.sciencedirect.com.ezproxyhost.library.tmc.edu/science/article/pii/S1386505611000463</ref>
*Ability to utilize staff badge as scanning tool to sign-in/out of the computer
*Workflow analysis of all users
*Proper training and information to users <ref name="SSO"></ref>

The right single sign-on (SSO) solution will enable your users to securely log on once to access all their applications. 
This capability:
*Protects information
*Reduces password-related helpdesk calls
*Improves employee satisfaction
 
Not all SSO solutions are the same, however. As you start your evaluation process, it helps to know which questions to ask in order to gain a thorough understanding of product features, implementation, and ongoing management. This list will guide you through your due diligence.<ref name="Single Sign On">Single Sign-On Vendor Selection Evaluator's Guide.http://www.healthitoutcomes.com/doc/single-sign-on-vendor-selection-evaluator-s-guide-0001</ref>

=== Software ===
Identify and prioritize the organization’s technical requirements from current and future state workflow analysis. The following specific needs should be outlined: 
# Any necessary cleansing of the Master Patient List
# Existing System Data Conversions 
# Modifications to current hardware, software, and interfaces
# Regulatory requirements that may affect system changes 
# Possibly In-house Customization 
# Anticipated nonstandard system use <ref name="AHIMA"> The RFP Process for EHR Systems (Updated). Developing and Disseminating an RFP (2010). http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_047961.hcsp?dDocName=bok1_047961 </ref>

Additional ICD-10 vendor guidelines and considerations include: Does the system require increased storage capacity? Are the necessary upgrades covered by current vendor contracts? What upgrade costs will the organization be responsible for? How will resources be allocated to manage all requirements? How will the organization budget for required systems changes? <ref name="mgma"> Is your practice ready? 5010 and ICD-10 vendor questions and guidelines. 20143. http://www.mgma.com/government-affairs/issues-overview/health-information-technology/icd-10/5010-and-icd-10-vendor-questions-and-guidelines </ref>

== Privacy and Security ==
* Does the system provide roadmaps for adherence to organizational policies (such as HIPAA)?
* Does the vendor’s EMR source code comply with the Patient Safety & Quality Improvement Act of 2005 (PSQIA)?
* The system shall allow an authorized administrator to enable or disable auditing for events or groups of related events to properly collect evidence of compliance with implementation-specific policies. Note: In response to a [[Health Insurance Portability and Accountability Act (HIPAA)|HIPAA-mandated risk analysis]] and management, there will be a variety of implementation- specific organizational policies and operational limits.
* Internet Connectivity and Redundancy Contract - There are three main types of connections for clinical data connections: business class digital subscriber line (DSL), business class cable, and T1 connection. Redundant back up systems and procedures to ensure your data will be backed up in multiple locations and securely stored off-site. 
* Will the system allow staff administrators to create and manage users and [[Data security|user security profiles]]?
* The system restore functionality shall result in a fully operational and secure state. This state shall include the restoration of the application data, [[Security|security credentials]], and log/audit files to their previous state.
* If the system includes hardware, the system shall include documentation that covers the expected physical environment necessary for proper secure and reliable operation of the system including: electrical, HVAC, sterilization, and work area.
* How well does the EMR work with antivirus, antispyware and other security software?
* What is the vendor’s history with cyber attacks? <ref name="mit cybersecurity">MIT Geospactial Data Center: Protecting EMR Data (1 of 2) http://cybersecurity.mit.edu/2012/11/protecting-emr-data-1-of-2/</ref>
* Does the system allow for off-site access to files/data and how does the technology protect against external breech or diversion of patient information?
* Does the system have role based permission and access? Different job roles should only be able to access what is required of their job. <ref name="Ensuring Security of High Risk Information in EHRs">http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_039956.hcsp?dDocName=bok1_039956</ref>
* Are all messaging capabilities within the EMR encrypted? <ref name="Electronic Health Records: Privacy, Confidentiality, and Security">http://journalofethics.ama-assn.org/2012/09/stas1-1209.html </ref>
* Does the system have the ability to audit / monitor user activity if needed?<ref name="Electronic Health Records: Privacy, Confidentiality, and Security">http://journalofethics.ama-assn.org/2012/09/stas1-1209.html </ref>
* Does the system have time-stamp functionality (name, date, & time)? <ref name="Security Risk Analysis Tipsheet: Protecting Patients’ Health Information">http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/SecurityRiskAssessment_FactSheet_Updated20131122.pdf</ref>
* Is the system in compliance with the organization’s HIPPA policy?
* How will the decrease the unauthorized disclosure of information?
* What procedures does the vendor have to handle disaster recovery and high availability issues?
* Does the vendor's data policy and application security features meet established standards for disposing of  PHI?<ref name="FAQs About the Disposal of PHI">http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/disposalfaqs.pdf</ref>
* How often do users have to update password information and credentials?
* What does the vendor offer in regards to data backup procedures to ensure privacy and security integrity?
* How often are user ID’s audits performed for inactive users?<ref name="information security">Information security policy template. (2011). Retrieved from http://www.healthit.gov/sites/default/files/info_security_policy_template_v1_0.docx.</ref>
* Can the system detect a security breach, report the breach to the appropriate persons and take other actions to counter or thwart the breach in real time?
In an article "Electronic Medical Records: Confidentiality, Care, and Epidemiology" by Lesk, <ref name="Confidentiality and Security">Lesk, M., "Electronic Medical Records: Confidentiality, Care, and Epidemiology," in Security & Privacy, IEEE , vol.11, no.6, pp.19-24, Nov.-Dec. 2013
doi: 10.1109/MSP.2013.78,
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6560004&isnumber=6682920
</ref> The authors raise two important factors related to the privacy, one is the privacy and confidentiality for patient data and the other is the privacy required by the software vendor to keep its software private. Some of these privacy restrictions prevent even sharing the screen savers and reporting the adverse events to FDA due to software issues. Vendor may come and fix these issues however, as different installations and systems may face different issues at different times it may not be possible to attribute clearly the adverse events to the EMR itself. In addition to promote research and for epidemiological reasons there is a desire to obtain patient data in real time which conflicts with keeping the patient information secure and confidential. EHR vendors should be questioned about the sharing and reporting of the software bugs. They should also be questioned about methods of de-identifying the patient data.


=== Results Management Requirements ===
Results management is an important clinical activity that requires a structured approach in order to be effective. Results management is in accord with the precepts of Meaningful Use. Incorporation of clinical lab results into the EHR as structured data is an ongoing MU objective. <ref name="results Mgt"> Carter, J. A New Look at Results Management. 2012. http://www.americanehr.com/blog/2012/07/a-new-look-at-results-management/ </ref>
* Lab Results
** Will the system send the lab request electronically?
** Will lab results populate electronically into the EHR with flags for abnormal result?
** Will Physicians be able to review and publish lab results as well result notes to patients electronically?<ref>Patient Results. https://www.labcorp.com/wps/portal/patient/results</ref>
** Will the system suggest follow up test depending of test done and results obtained?
* LOINC Codes
** Will the EHR accept LOINC-mapped electronic lab results if available from the source lab <ref name="functional"></ref>?
*Radiology Results
** Will the system  accept radiology results and reports electronically from imaging centers or through the HIE? <ref name="functional"></ref>
** Does the EHR support the direct viewing of DICOM medical images without having to log into the separate PACS system?<ref>Radiology Today. http://www.radiologytoday.net/archive/rt0513p18.shtml </ref>
** Does the EHR has time tracking of performed or to be performed procedures that are happening in the imaging in the form of “in progress”, “completed” or “discontinued”?
** Does the EHR consist critical result notification application?
** Does the EHR allow insurance authorization upon imaging order?<ref name=“ IT REference Guide for the Practicing Radiologist “> Kevin W. McEney MD. Radiology Information Systems and Electronic Medical Records http://www.acr.org/~/media/ACR/Documents/PDF/Advocacy/IT%20Reference%20Guide/IT%20Ref%20Guide%20RISEMR.pdf</ref>
* Reminder of next test due
** Will the system set a reminder for recommended time frame for next lab test <ref name="functional"></ref>?

===Specialty Needs (Pediatrics)===
EHRs in pediatric care may increase patient safety through standardization of care and reducing error and variability in the entry and communication of patient data. While EHRs may improve safety, implementation of general EHR systems that do not meet pediatric functionality and workflow demands could be potentially dangerous. One of the main reasons for pediatrician to be reluctant in adopting EMR is lack of pediatric supportive system <ref name="Leu 2012">Leu, M. G., O’Connor, K. G., Marshall, R., Price, D. T., & Klein, J. D. (2012). Pediatricians’ use of health information technology: a national survey. Pediatrics, 130(6), e1441-e1446.</ref>. Healthcare organization have to be careful to select prospective EMR vendor to determine if they have incorporated a variety of Pediatric specific workflows into their system. 
For instance,
*Will the EMR be able to address pediatric patient identification issues like prenatal identifiers, newborn identification, name change, multiple birth, and mother-infant link? <ref name="Kim 2008">Kim, G. R., & Lehmann, C. U. (2008). Pediatric aspects of inpatient health information technology systems. Pediatrics, 122(6), e1287-e1296.</ref>
*Are EHR provide child'a age in years or EHR have the ability to determine ages in hours, days, weeks and months in addition to years?
*Are dosing models consistent with taking care of a pediatric patient population?
*Does the EMR provide interoperability with electronic state and local immunization registries? <ref name="Spooner 2007">Spooner, S. A. (2007). Special requirements of electronic health record systems in pediatrics. Pediatrics, 119(3), 631-637.</ref>.
*Does the EMR have ability to perform percentile calculations? <ref name="Spooner 2007"></ref>.<ref name="Rosenbloom 2006">Rosenbloom, S. T., Qi, X., Riddle, W. R., Russell, W. E., DonLevy, S. C., Giuse, D., ... & Spooner, S. A. (2006). Implementing pediatric growth charts into an electronic health record system. Journal of the American Medical Informatics Association, 13(3), 302-308.</ref>
*Does the EMR allow pediatric growth monitoring functions like growth charts and growth velocities? <ref name="Rosenbloom 2006"></ref>
*Does the EMR allow special privacy handling of adoption records as per applicable state laws? <ref name="Spooner 2007"></ref>.

*are they provide pediatric specific EHR features such as Intake forms,Demographics that support various family structures,Well child / Preventative,Immunization administration and management,Growth Charts,Genetic information, maintenance, and reporting,School Physical,Sports Physical,Camp Physical,Daycare Physical,Reportable Communicable Disease management,Child abuse reporting forms,Referral entry and tracking,VIS (Vaccine Information Sheet),CDC link,Flack Pain scale,Behavioral tools,ADD/HD tools,Age Specific,Birth Data,Instrumentation integration (vital signs, EKG, spirometry, etc,Pediatric protocols for pediatric triage,Patient Portals,Pediatric Specific templates?

=== Specialty Needs (OBGYN) ===
There are unique requirements from electronic medical records systems for obstetrics and gynecology, and rooting out vendors that provide the ability to support those requirements can be challenging.Unfortunately, until CCHIT adds OB/GYN as a specialty endorsement (not slated until 2012),there are no externally validated organizations that assure the prospective purchaser that the product meets all of the required needs. Of course, should one be in a sub-specialty practice (MFM, REI), there are even fewer assurances offered on suitability;  it will be up to the individual/organization to sift through the vendors and product capabilities to match with the stipulated needs.<ref>http://www.acog.org/About-ACOG/ACOG-Departments/Health-Information-Technology/EMR-Vendor-Selection-Process</ref>

===Specialty Needs (Anesthesiology)===

Anesthesiology is a unique medical specialty, as it is a field of acute care for medicine.  Due to the fast-paced nature of emergency situations, critical pieces of information to make decisions are necessary to determine a good or bad outcome.  Elements such as body weight, drug metabolism, drug interactivity and allergies are emphasized.  The communication of the anesthesia provider during the case is more profound between him/herself and the operating room staff (surgeon, circulating nurse, scrub technician) than with the patient.  

====EMR Requirements====

Anesthesiology-specific workflow templates reduce errors by automatically populating patient data and supporting treatment.

* '''Vital Signs Device Integration''' - Capture physiologic data—including ECG, oxygen saturation, heart rate, blood pressure, end-tidal CO2, temperature and respiration—from anesthesia machine to ensure appropriate levels of anesthetization. 
* '''Interaction with Current System EMR''' - After capturing the physiologic data from operating room specific devices, the EMR should integrate it automatically into the patient's chart to be part of the permanent medical record.
* '''Alarms''' - Due to the potent nature of anesthetic drugs, alarms should be available to monitor drug-drug interactions and vital signs should have trend monitors to predict the possibility of impending cardiopulmonary arrest.
* '''Timers''' - Medicines given in this specialty are very time-sensitive in their time of onset and duration of action.  Having the capability of tracking the last dosage and time since the last dosage or due time of the next dosage would be extremely beneficial.
* '''Graphing Capabilities''' - With continuous fluctuations in vital signs, the ability to graph these allows the care provider to quickly and easily view changes over time and  treat any issue immediately and appropriately.
* '''Medication Pump Integration''' -Anesthetic gases, such as sevoflurane and isoflurane, and pain medications, such as remifentanyl, are given continuously in some surgical cases, and with the interoperability of the EMR with these pumps, allows for accurate recording of quantities and doses administered to the patient as well as time-sensitive recordings.
* '''Unique user sign-ons''' -With the capability of having unique user sign-ons, it allows the ability to track all anesthetic personnel associated with the record and who administered the medications or completed an activity.
* '''Narrative Capability''' - By allowing the ability to also include narratives, in addition to automatically sync information, it allows the clinician to provide as much detail as deemed appropriate regarding a situation or case.

=== Other Clinical Functionality  ===

* Does the system promote delivery of safe care?
* The system shall require documentation of the audit support functionality in the vendor provided user guides and other support documentation, including how to identify and retrospectively reconstruct all data elements in the audit log including date, time.
* Can the system identify the chronic disease management subgroups?
* Is the EHR scalable to different medical specialties and practice demographics (i.e., Neurology vs. Cardiology, small satellite practice vs. intensive care unit) 
* Can the system support future clinical models (i.e., Medical Home)?
* Does the EHR system support accurate, consistent and effective clinical documentation by appropriately balancing data auto-population, structured data entry, and unrestricted physician entry of natural-language narrative?
* Does the EMR have the capability to display data over time graphically, such as growth charts?
* The system shall provide the ability to query for a patient by more than one form of identification
* Can it integrate with external knowledge sources such as links to journal references or other knowledge base systems (such as [http://www.hopkinsguides.com/ John Hopkins Guidelines System]) to provide more academic information and update on particular patient problem?
* Does the EHR store the identity of the user and associate the ID with the additions or changes made to the system?
* Can the EHR system be used to capture clinical trial data? How the clinical trial specific data is managed?
* Does the EHR system have the ability to import and export data (interact) in a standard format to EHR systems from other vendors?
*In outpatient departments, does the EHR have a patient-to-physician email and/or web access abilities for the outpatient department to communicate directly with the patient in case more information is needed or the office needs the patient to take some action?<ref name="KDHE 2008">Kansas Department of Health and Environment 2008: Selecting an EHR, Now What??? http://krhis.kdhe.state.ks.us/olrh/Notices.nsf/bf25ab0f47ba5dd785256499006b15a4/720f6f7bfa876f0a862573c600595a2f/$FILE/EHR%20System%20Selection%20Process.pdf</ref>.
* Does the vendor’s product provide the key functionality needed to achieve the organization vision?
* Does the EHR provide outcomes data in terms of key metrics (cost savings, medication error reduction, disease management) in line with the vision of the organization?
* How does the system import data from personal health devices?
* Can patient data be directly imported from patient portals or [[PHR|personal health records]]?
* Does the vendor provide an EHR system that can be integrated with and is interoperable with other systems?
* Can the vendor provide an EHR system with standard terminology that is cross platform with other EHR systems?
* Does the vendor provide safe log in for patients and clients?
* Does the EMR could provide appropriate information on screen without cramming too much information?
* If the EMR/EHR system allows users to access through mobile devices (through the web or an app), is the mobile version similar to the computer-based version? Is it user-friendly? Will mobile access require additional training, or will user feel comfortable with it after training on the computer-based version?
* What type of system is built into the EHR for clinicians, staff and any other users to provide feedback?
* Does the EMR/EHR integrate with off the shelf software currently in use? (i.e. Microsoft products, adobe, etc.) and will new software/upgrades need to be purchased to enable inter-operability?
* Is the EMR capable of sending a Virtual Consultation Summary to another Physician via HIE?

==== Continuity of Care: Outpatient vs Inpatient EMR ====
Healthcare delivery in US is fragmented; a single provider can work for more than different healthcare organization and can have his own private practice. A healthcare organization may also provide care to both inpatient and outpatient through its hospital or hospitals and as well as outpatient clinics that may be spread over a city.  For an organization that takes care of patients in both inpatient and outpatient settings having a single EMR system that can meet the needs of a patient across that continuum is desired. 

If there is no communication between the ambulatory (outpatient) and the inpatient (hospital admissions) EMR services, the clinical information may not be shared or available at the time of care. The EMR vendors must address this need for continuity of care by looking at the integration between their outpatient and inpatient clinical systems.

The level of integration can be-
#at the user interface level (for example, separate inpatient and outpatient applications, minimal data sharing with separate databases, viewable in same shell) 
#at the database level (such as having two separate applications and one database, with the ability to manually transfer data between applications)
#at the workflow level (with one application and one database, with data displays in the context of care setting and full accommodation for workflow) 
I favor number 3 option over number 1 which is least desirable.
 
A discharge summary is needed at the time the patient is discharged from the hospital. This allows for a smoother transition of care from the inpatient to the out-patient setting. According to JCAHO (Joint Commission) ''medication reconciliation'' must be done at every transition of care. There is very little literature that addresses the direct financial ROI for an ambulatory EMR, as opposed to the inpatient arena, where more evidence exists.<ref name="Continuity of Care">Using an evidence-based approach for system selection at a large academic medical center: lessons learned in selecting an ambulatory EMR at Mount Sinai Hospital. http://www.ncbi.nlm.nih.gov/pubmed/16669592</ref>

Cerner Ambulatory and Cerner Inpatient
Cerner has recently deployed their “Cerner Integrated” platform that does “speak” to inpatient Cerner. Cerner deployed this to "improve the quality and accessibility of clinical documentation across the inpatient and outpatient venues of care while reducing costs of transcription and document scanning." Jim Shave, President of Cerner in Canada, stated “This integration between inpatient and outpatient systems will provide a seamless experience for patients and clinicians, particularly with the large volume of Ontario residents who use outpatient hospital care.” It is still fairly new and not a lot of hospitals and outpatient clinics have had the opportunity to experience the flow of this integrated platform but this is a step in the right direction for continuity of care. <ref name="Cerner">Cerner Hospital Information System in Extended to Ambulatory Clinics in Three Ontario Hospitals. http://www.cerner.com/Cerner_Hospital_Information_System_is_Extended_to_Ambulatory_Clinics_in_Three_Ontario_Hospitals/</ref>

CPRS in VISTA provides the ability to share medical records of a patient from inpatient, outpatient and specialty care from a single interface. By allowing the providers to build their own specialty specific templates for note entry it is able to achieve this functionality without being excessively burdensome to any.  <ref name="Vista">Steven H. Brown, Michael J. Lincoln, Peter J. Groen, Robert M. Kolodner, VistA—U.S. Department of Veterans Affairs national-scale HIS, International Journal of Medical Informatics, Volume 69, Issues 2–3, March 2003, Pages 135-156, ISSN 1386-5056, http://dx.doi.org/10.1016/S1386-5056(02)00131-4.
(http://www.sciencedirect.com/science/article/pii/S1386505602001314)
/</ref>

=== Management and Reporting Requirements ===

The [[Request for Proposal (RFP)]] has a requirement for a risk management plan. This plan includes:
# Risk identification
# Risk analysis
# Risk evaluation
# Risk treatment and contingency plan
# Risk monitoring
Identifying and understanding factors such as product risk, process risk, financial risk, and schedule risk when initiating a contract ensures appropriate measures can be implemented to mitigate the risks. <ref name=”PHE”> Department of Health and Human Services Office of the Assistant Secretary for Preparedness and Response (2015). Public Health Emergency. The ASPR Business Toolkit. http://www.phe.gov/about/amcg/contracts/Pages/toolkit.aspx/</ref> The risk management plan will be used to identify risks and how they are reported and affect the progress of the project.<ref name=”TCPA”> Texas Comptroller of Public Accounts (2015). Contract Management Guide. Chapter 2 - Planning.  http://comptroller.texas.gov/procurement/pub/contractguide/</ref> The status of the risk management plan should be included in project status reports. <ref name=”CMTP”> Texas Comptroller of Public Accounts (2014). Texas government project management. Contract Management Training and Certification. http://www.comptroller.texas.gov/procurement/prog/training-cert/cmt/</ref>

back to [[Vendor Selection Criteria|home, Vendor Selection criteria]]

== References ==
<references/>