Barry Sarvet, MD

When personal computers were introduced to the consumer marketplace in the late 1970s, many considered them to be very expensive toys with limited practical application. Now computers are ubiquitous, and many of us-especially our youngest colleagues-have difficulty in imagining life without them.

Computerized information resources are being introduced into psychiatric practice settings, but some psychiatrists question whether they are really needed. Yet the entire health care system, including psychiatry, is progressively “going digital,” and there seems to be little question that within the coming decade, the vast majority of health care information will be digital.

Although the benefits may not be immediately apparent and there are risks that need to be considered, the adoption of health information technology (HIT) in psychiatric practice is necessary for the optimal integration of mental health care in overall health care service delivery. HIT has the potential to substantially improve quality and efficiency of psychiatric services.

Although many psychiatrists who work in multispecialty group practices, hospitals, community mental health centers, and residential treatment programs are likely to already be using electronic medical record (EMR) systems, many independent psychiatry practices are in a “pre-contemplative” stage of change in regard to the adoption of HIT.

Although psychiatrists have lagged behind their colleagues in other fields of medicine in the adoption of HIT in their practices, many are learning the benefits of this technology.

 Federal government incentive programs have stimulated the implementation of HIT; however, these programs have not been readily accessible to psychiatrists in private practice. Nonetheless, the advan­tages of EMRs and related resources are quite compelling.

The Agency for Healthcare Research and Quality (AHRQ) has reported substantial savings for practices that implement an electronic health record.

 Cost-benefit analyses over a wide range of practice types uniformly show that long-term financial benefits outweigh initial investment costs. Of course, the actual financial impact of an electronic health record may vary according to the size of the practice, the features and design of the technology, the existing overhead structure of the practice, and the effectiveness of implementation.

In psychiatry, for example, an EMR system with efficient use of templates and speech recognition software can eliminate transcription costs and automate various clerical tasks. With the minimal overhead expense of most private psychiatric practices, improvement in the efficiency of clerical tasks can directly reduce uncompensated time and effort of the psychiatrist.

 HIT facilitates communication across specialties and the practice of collaborative care. The adoption of the medical home model across health care has created a critical need for specialists to effectively communicate with primary care physicians. While true interoperability between various HIT products continues to be an elusive goal, there is currently a great deal of momentum in the development of systems for health information exchange, allowing for health information to be transmitted between different EMR systems. This will allow the information to follow the patient as he or she moves between various components of the health care system.

Until these health information exchange systems are implemented, EMR systems can automate the preparation and transmission of clinical information to providers outside of a specific EMR system through secure messaging technology as well as traditional channels, such as fax and regular mail.

 Functions such as electronic prescribing can dramatically reduce adverse drug reactions through alerts regarding drug-drug interactions and can eliminate the problem of typographical errors on written prescriptions.

 EMRs can more effectively bring important safety-related clinical information, such as allergy and adverse drug reaction history, to the attention of the provider in the context of care delivery through rules-based decision support functions. Templates for progress notes in EMR systems offer a framework for the creation of legible, complete, and clinically useful information in the medical record.

Many practices have documented that appropriate use of technology has led to more efficient workflow.

 HIT resources such as patient portals (which allow patients to transmit clinical history forms and rating scales to, and enable secure messaging with, the provider or office) can improve the patient experience and facilitate the incorporation of routine structured assessments of symptom severity into clinical practice. EMR systems may allow providers to develop patient registries to track outcomes and processes of patient care for groups of patients with similar diagnoses to improve the quality of care.

Although concerns about the confidentiality and security of psychiatric information in EMR systems are quite warranted, it can be argued that electronic systems have more robust capacity to protect sensitive clinical information than do paper records.

 If rigorously deployed, technological features such as data encryption, electronic audit trails, automated off-site backup functions, and user access controls not only can prevent unauthorized access to information but also can ensure that critical data are not accidentally lost or destroyed. (Editor’s note: please see the Special Report article “New Risks to Confidentiality in the Modern Era” by Dunne and colleagues for more on this topic.)

Choosing the right technology for your practice

With hundreds of HIT products on the market today, identifying the right products for a practice’s needs can be a daunting task. It is good to remember that the “perfect” HIT product simply does not exist, and every product will have its own strengths and weaknesses in the context of the individual practice’s needs. Before getting started with the process of “shopping around” for technology, it is a good idea to understand some of the basic functions of these products.

Products range from all-inclusive “package systems” to “modular pieces” with a single function. While you may be tempted to find a product that meets every one of your needs, many have found that using multiple components to meet fewer needs is also effective. When using modular products, keep in mind that the ability of these products to interface with one another is crucial to a well-run system.

 Functions such as scheduling, registration, billing, and patient accounts can be found in many stand-alone as well as package products. Some products add the ability to use a computer in the waiting room to gather information from the patient for use during the clinical session. Other functions can include tracking uti­lization review/insurance information and managing informed consent documents.

 Patient portals offer secure methods to allow patients to exchange information with their provider. This is akin to online banking or airline reservations. This evolving field of HIT can enable patients to read or download selected elements of their medical record, such as test reports and evaluation summaries; to request and/or schedule appointments; to personally submit information to the medical record, such as history; to complete assessment measures; and to exchange messages with their provider.

 This is the “meat and potatoes” of most EMR products. These functions facilitate documentation of the clinical aspects of a practice. Most products offer some form of customizability in the templates used for documentation. Providers should find a level and mechanism of customization that fits their needs.

Some psychiatric products offer the functionality to handle security and access psychotherapy notes uniquely. Integration of rating scales and screens into clinical documen­tation is another potential feature. Many products offer the generation and maintenance of a Problem/Diagnosis list as a function of clinical documentation. Scanning of paper documents can also offer a bridge between traditional “paper-based” practices and the “paperless” office.

 Various EMR solutions integrate tools to manage medications. Potential features include support for formularies, drug interaction/allergy checking, FDA indication monitoring, and black box alerts. The term “electronic prescribing” refers to the electronic transmission of a prescription order to a pharmacy. This is distinguished from the use of a computer to print a prescription document or to fax an electronic version of that document to a pharmacy.

Federal regulations currently allow electronic prescribing of controlled substances. However, the technological requirements of these prescriptions specify the use of “two-factor authentication” that requires biometric identification or a physical cryptographic key in addition to usual password protection. This, along with more restrictive regulations in some states, has thwarted the complete development of this function.

 Many HIT products can help facilitate the generation of a variety of reports about your practice. Clinical, business, and utilization reports are just a few of the many types of reports this technol­ogy can generate to help summarize the data that are collected by your EMR system.

 Some of the most important characteristics of this technology have to do with the user interface and usability in your practice environment. Various products offer features such as pen and tablet interfaces, mobile access, and a variety of other technical features that may or may not be of use to you. Other important technical characteristics include how the technology is implemented-some systems involve local (on-site) data processing and storage, while others are “cloud-based” systems in which data storage and processing occur on a remote server.

Cloud-based systems are generally associated with much lower initial cost and technical support expense; however, there is often less flexibility and absolute control over the data, and the system depends on a robust and reliable Internet connection. Local systems may be cost-effective for large practices that may be in a position to invest capital resources and can spread the overhead expense across a large group of providers.

The implementation of HIT re­sources may be a substantial, if not the largest, overhead expense for a psychiatric practice. The many decisions involved in configuring a system should therefore be guided by a clear strategic plan for the practice.

Knowing what you need and want is quite helpful. If resources are limited, you may need to prioritize your list of desired features and identify those that are absolutely necessary. In keeping with long-term goals, you may choose a system that allows for features to be added over time and that has the capability to export data if you need to switch vendors in the future.

If your expectations and needs for information technology are modest, you may be able to manage your medical records, accounts, and schedule with a standard office productivity software suite, perhaps supplemented with small-business accounting software. For electronic prescribing, you will need to choose a vendor to securely transmit prescription orders to pharmacies. You will also need to have a security plan in place to protect patient information from unauthorized access, and all information will need to be backed up daily. In addition, if you are in private practice, keeping all the old paper records in a file cabinet may be a satisfactory alternative to scanning all of the paper into the EMR system.

The transition to an EMR system is a process that unfolds over time. During the early stages of implementation, everything will take a bit longer than it did on the paper system and you may even regret embarking on this change. But, with appropriate commitment, training, and customization, the efficiencies and benefits will gradually become apparent.

In addition to simply learning how to operate and customize the new technology for your practice, it will also be important to evaluate, and if needed, redesign the workflows of your practice to optimally integrate HIT. New tools often warrant changes in processes that involve not only physicians but support staff as well.

It is important to plan the extent to which EMRs will be used during the face-to-face portion of the visit and to carefully consider its impact on your personal interaction and rapport with the patient. For example, it may be helpful to have the patient present when you are updating the medication list and reviewing and discussing laboratory results and other medical data. If so, will the monitor and keyboard be configured so that the patient can jointly view the information? Do procedures for patients to communicate with you and/or your office staff need to be redesigned to optimally use your new communication tools? The impact of HIT on the patient experience, and especially on the relationship between doctor and patient, is an emerging area of interest in informatics research and a compelling issue for clinical study.

In addition, a plan for maintaining previous paper records needs to be in place. Several options are available: maintaining the availability of paper charts for every patient visit for a specific length of time; archiving the paper records for access on an as-needed basis; and scanning some or all paper records for viewing within the electronic system. Many practices choose a combination of these methods.

Opinions about the implementation of this type of technology vary as widely as the number of HIT products available on the market. Preparation and research can enhance the likelihood that practitioners will realize the potential benefits of a more efficient, cost-effective, and clinically sound practice through technology.

 Moran M. Physician EHR use gains steam, but psychiatrists slow adopters. 

 Shekelle P, Morton SC, Keeler EB. Costs and Benefits of Health Information Technology. Rockville, MD: Agency for Healthcare Research and Quality; April 2006. Evidence Reports/Technology Assessments 132. http://www.ncbi.nlm.nih.gov/books/NBK37988. Accessed November 14, 2012.

 Ammenwerth E, Schnell-Inderst P, Machan C, Siebert U. The effect of electronic prescribing on medication errors and adverse drug events: a systematic review. 

 Terry K. Rev up your EHR: how to optimize performance. Learn ways to increase revenue, improve practice efficiency and quality. 

 Barrows RC Jr, Clayton PD. Privacy, confidentiality, and electronic medical records. 

 American EHR Partners. http://www.americanehr.com. Accessed October 31, 2012. 

Articles

Computerized information resources are being introduced into psychiatric practice settings, but some psychiatrists question whether they are really needed.

Computers in the Consulting Room

Over the past decade, an enormous wave of innovation in information technology has rapidly transformed health care services, including those for psychiatry. The most prominent example of this is the adoption of electronic medical record (EMR) systems in medical and mental health practice. One of the most desirable features of this technology is the ability to share and exchange information between health care providers and patients.

Although the risk of confidentiality breaches and security has always existed with conventional psychiatric records, the automation and speed of electronic communication may increase this risk. As health care organizations scramble to comply with aggressive timetables of federal incentive programs for using EMRs, they may overlook the special sensitivity of psychiatric records and thereby increase the risk of violating patient privacy.

As with paper records, information from a patient’s EMR can be transmitted to an external party or shared through joint use of the EMR by associates of the patient’s provider. Transmitting the information electronically is akin to sending a copy of the paper record, and this type of release is subject to state and federal laws. Although HIPAA permits disclosure of health information to other providers for the purpose of coordination of care without express patient consent, states have the right to override this permission. Accordingly, many states have enacted statutes that do require patient consent.

EMR sharing may extend across thousands of employees within large medical groups and health care systems. It is largely unregulated and the patient is considered a member of the organization rather than “belonging” to an individual provider. Such widespread access to psychiatric information without a formal release process is unprecedented and undermines ordinary assumptions regarding confidentiality among patients and providers.

What new information does this article provide?


It provides information about types of electronic connectivity and electronic medical records that can be used in psychiatry as well as case examples to illustrate and strategies to mitigate risk for practitioners considering their use.

What are the implications of digital technology for psychiatry?


If psychiatrists are considering using various types of electronic communication, they should do so thoughtfully and carefully to ensure that they safeguard patient confidentiality.

Strategies to maintain patient confidentiality

Because of issues related to securing patient information, some organizations have chosen to exclude psychiatric records from the EMR. Others have secured psychiatric information in a restricted area that is only accessible by the psychiatrist and his or her immediate colleagues. These solutions minimize the risk of confidentiality violations but may hinder the promise of improved coordination and safety in patient care afforded by EMRs. More practical solutions include allowing shared access within a health care system of a limited subset of psychiatric information, such as diagnosis, medications, identification of psychiatric providers, and basic information about treatment.

Other strategies include detailed advance disclosure to patients regarding the scope of shared access, and provisions that allow another treating provider and immediate-covering clinicians limited access to specific, or “granular,” elements of evaluation and therapy notes (ie, detailed family history, psychotherapy process notes, and highly sensitive elements of social history). Some systems contain warning messages, also known as “break-the-glass” alerts, that discourage providers from attempting to view psychiatric information unless they have a specific need for this information.

Most EMR systems allow compliance officers to review the history of who accessed a record and when it was accessed, to investigate any concerns regarding the possibility of unauthorized access. This deterrent is not possible with paper records.

It is essential for psychiatrists to learn about the design characteristics of their EMR systems relating to shared access, transmission of information to other providers, and patient portals. Psychiatrists must fulfill their ethical and legal obligations to safeguard the confidentiality of their patients’ psychiatric information as well as accurately inform patients regarding the extent to which their information is accessible to colleagues within a system. The following case vignettes illustrate some of the challenges psychiatrists might face in balancing the need to protect confidentiality with the importance of sharing information with providers involved in caring for their patients.

A psychiatrist treats a 25-year-old man for anxiety, depression, and polysubstance abuse. Part of the treatment involves prescribing medication for withdrawal. During the course of treatment, the psychiatrist receives a signed release of information from the patient’s primary care physician (PCP), who is requesting a copy of the medical record. The release does not specify substance abuse records, and regulations in the psychiatrist’s state require a specific authorization for their release. The psychiatrist inadvertently releases the patient’s record to the PCP, including the substance abuse treatment information, which the patient did not authorize him to release.


In this case, it appears that the psychiatrist violated a state law in releasing the substance abuse information without the patient’s consent. If the patient opposes the release of this information to the PCP, the reasonable course of action could have been to negotiate a compromise with the patient regarding releasing a subset of the most pertinent elements of the substance abuse history and treatment in relation to the patient’s medical care. Once a compromise is reached, the EMR needs to be able to generate a custom document with a compilation of the agreed-on elements of the psychiatric treatment record. If the patient refused to compromise, then the psychiatrist would be obligated to keep the PCP in the “dark”-a potentially untenable situation for both the psychiatrist and the PCP.

There may be general agreement on sharing some benign aspects of the record, such as dates on which the patient was seen; vital signs; diagnoses; and medications prescribed, with dates, doses, and response. However, deciding what information to share beyond this-and with whom-can be more challenging. Some have advocated for bringing the patient into the decision. While it may seem perfectly reasonable for patients to have the right to decide on release of their confidential information, it may be legally permissible under HIPAA to override the patient’s preference in disclosing health information between concurrently treating health professionals for the purpose of coordination of care.

A 35-year-old woman is a patient of both a PCP and a psychiatrist. The PCP is part of a group that uses an EMR system. The psychiatrist uses a paper and dictation system and does not have access to the same EMR system as the PCP. The psychiatrist prescribes a medication for the patient for treatment of bipolar disorder. The patient discloses that she is also taking a drug prescribed by her PCP that is known to interact with the agent being prescribed by the psychiatrist.


The psychiatrist informs the patient that he will need to advise the PCP of the potential for medication interaction. To provide comprehensive, collaborative treatment, the psychiatrist also indicates that he wishes to discuss the patient’s psychotherapy treatment with the PCP. The patient refuses to allow the psychiatrist to communicate with the PCP. After a thorough discussion with the patient, the psychiatrist documents the patient’s informed refusal and indicates to the patient that he cannot continue to prescribe medications unless he coordinates with the PCP. However, on the basis of the patient’s express wishes, he will not forward any information about the psychotherapy treatment. The patient is agreeable to this. The psychiatrist then obtains written informed consent specifying that he can discuss with the PCP medications prescribed and provide information.

This is an example of successful negotiation resulting in a reasonable decision regarding elements of psychiatric records that are acceptable to the patient to be shared “internally” with a PCP. Many systems have an “all or none” approach regarding access to psychiatric information among providers in different clinical programs. Ideally, systems allow providers to make nuanced decisions about which elements to include in shared record systems, after considering individual patient preferences, safety concerns, and clinical quality. Psychiatrists may advocate for this EMR characteristic as purchasers of systems for their private practice or if employed in an administrative role within an organization.

Psychiatric records commonly include references to other family members. Some of this may not be complimentary to those family members. However, the information is an important element of a psychiatric evaluation, especially for children and adolescents. Access to this type of information within EMR systems should ideally be limited to those who are providing the psychiatric treatment. This is another example of the utility of a feature that allows control of access privileges for specific, selected elements of the psychiatric record-“granular control.” This may be a particularly important consideration in treating a minor, since many EMR systems allow a patient access to his or her records and, by extension, usually to a minor’s parent(s)/guardian(s) with legal authority.

Notably, adolescents often have a strong interest in maintaining some degree of privacy in the relationship with their psychiatrist. In other words, they may not wish to disclose some treatment issues to their parents. To support this interest, systems should have provisions to comply with legal requirements regarding confidentiality for adolescents. This is especially important in the implementation of patient portals. It is also another example of the utility of granular controls that allow providers to apply more stringent access rules for certain types of notes or specific fields within notes.

Sally and Tom are currently going through a divorce and a custody battle. The court temporarily gives Sally sole legal custody of their son, Jim, and orders that he remain with her. Jim is being treated by a psychiatrist, and Tom’s attorney sends a record request with signed consent to the psychiatrist requesting release of the records. Absent court order or Sally’s consent, as the parent with legal authority, the psychiatrist incorrectly complies with the request and releases the complete record, including information about Sally. Tom’s attorney then uses this information in court against Sally.


This is an example of an unauthorized transmission of psychiatric information. As with paper records, any transmission of EMR information is subject to federal and state legal guidelines. The efficiency of the process of transmitting EMRs may allow providers to do so too quickly without additional staff involvement, thus creating a potential breach of confidentiality.

HIPAA regulations require that information release without patient consent be limited to the “minimum necessary” for coordination of care, payment, or health care operations but leaves the interpretation of that to the physician or the institution that designs or adapts the EMR for their purposes. However, in an emergency department admission of an unconscious patient, how much is “minimum necessary?” There, the adolescent’s dalliance with drugs or alcohol that he wanted to keep from his parents may be the critical piece of information to assist treatment. Unfortunately, because EMRs are computer systems, they cannot make judgments about what information to release in what situation.

Mobile devices may be extremely helpful to physicians, because they are frequently used for communication with patients and colleagues outside of regular business hours. Some devices allow full access to EMRs. The following vignette illustrates security vulnerabilities inherent in mobile devices.

A psychiatrist has been treating Beth who has been married to Mark for 5 years. Mark will not allow Beth to have friends or to interact regularly with her extended family or coworkers. Beth maintains some outside contact through text and e-mail without Mark’s knowledge. Because Mark often becomes jealous and confrontational, Beth keeps her smart phone in her purse so that Mark does not have access to it. The psychiatrist has encouraged Beth’s decision to leave her husband. Responding to one of Beth’s calls, the psychiatrist leaves her a text message with the contact information for the local battered women’s shelter. When Beth returns from a run, she discovers that Mark has accessed her cell phone along with her e-mails and text messages. He becomes agitated and assaults her.


This example illustrates the potential of unauthorized access to treatment information when communicating with mobile devices. Psychiatrists must consider that when using mobile devices, information can be accessed by unintended parties. Moreover, psychiatrists should be attuned to their specific patient’s clinical needs and that use of certain technology may not be appropriate in all clinical situations.

Psychiatrists can take steps to safeguard patient confidentiality when using various technologies.

 Computer security risks usually occur in 3 areas: access to records by unauthorized readers; information transmission problems when using phone lines/networks; and transfer of data to nonmedical users, such as insurers.

 Safeguards to prevent a data breach may include:

• Individual passwords for authorized users

• Automated audit trails identifying specific users

• Restrictions on copying/downloading patient files

• Using secure systems when accessing patient files remotely

Whether saving on a desktop or laptop computer, patient’s records should be properly stored. The portability of laptops makes them a higher risk for being lost or stolen. As such, particular attention should be paid to password protection and encryption.

Psychotherapy notes, if computerized, should be kept in a separate and secure file that is inaccessible to other users or other computers, unless the patient specifically authorizes disclosure to others.

 Furthermore, as an additional safeguard, if your EMR system has the capability, link access levels with specific roles (eg, “attending physician,” “medical assistant”).

Currently, there is little case law concerning use of e-mail with patients. If you elect to use e-mail with patients, it is strongly recommended that you use a HIPAA-compliant secure messaging platform. Such services have end-to-end encryption, ensuring that information transmitted across the Internet cannot be intercepted. Some EMRs have integrated secure messaging functionality, which allows users to receive and send encrypted messages without manually logging on to a separate messaging server. When patients receive a reply from their provider, they receive an e-mail notifying them that there is a secure message waiting for them; after entering their login credentials, they follow a link to view the message.

In the absence of a secure messaging system, e-mail exchanges between you and your patient should never be about clinical issues, but rather they should be limited to brief administrative issues, such as appointment changes.

 If you are e-mailing a patient at work, remember that the employer can access the e-mail, since it is the employer’s property. Thus, always ensure that you send e-mails to the patient’s personal rather than work account.

Communicating via cell phones, smart phones, and other wireless devices can increase the risk of inadvertent breaches of confidentiality because communications may be intercepted and overheard. If you are using such devices, inform the patient that you are and that there is a risk that the conversation may be overheard. In addition, to continue the conversation, get the patient’s consent and log the call into the medical record when completed.

Mobile devices used for e-mail, accessing a patient’s EMR, communicating with patients, scheduling appointments, and task management (including patient names or other patient identifying information) must have robust security features. Some of these include screen-locks after several minutes of inactivity, password protection on start-up and unlocking the screen, screen filters that limit visibility from an oblique angle, and the ability to remotely wipe data in the event that the device is lost or stolen.

The confidential nature of the relationship should be protected when leaving messages for patients.

 Using voicemail and answering machines to transmit confidential information may increase the risk of inadvertent disclosure because it is not always possible to know who may hear the message or is able to access the system. Thus, these systems should be set to low volume or soundproofed.

While this article highlights some of the modern-era risks to confidentiality that psychiatrists may experience, it does not constitute an exhaustive list of issues to consider and is not a substitute for legal advice. Modern technology is a moving target that evolves on a daily basis. As such, it is important to be aware of applicable state and federal regulations as well as principles of medical ethics.

 4th ed. Philadelphia: Lippincott Williams & Wilkins; 2007.

 APA Document Reference No. 200202, Appendix B. Documentation of Psychotherapy by Psychiatrists. http://www.americanmentalhealth.com/media/pdf/200202apaonnotes.pdf. Accessed October 30, 2012.

HealthIT.gov. Health information privacy and security: a 10 step plan. http://www.healthit.gov/providers-professionals/ehr-privacy-security/10-step-plan. Accessed October 30, 2012.

Kassaw K, Gabbard GO. The ethics of e-mail communication in psychiatry.

While this article highlights some of the modern-era risks to confidentiality that psychiatrists may experience, it does not constitute an exhaustive list of issues to consider and is not a substitute for legal advice.

Author | Barry Sarvet, MD

Articles

Computers in the Consulting Room

New Risks to Confidentiality in the Modern Era