
Regular readers of my column will recognize that I generally prefer to discuss concepts that the Mobile Medical profession should keep in mind, why they are important and how to pay for them. My interest is driving innovation to serve those who run toward crises.
I try to avoid writing about the how one should do things because, from charting to interoperability to financing community paramedicine, there are many ways to succeed. My suggestions are never the only possible way.
However, sometimes there of specific things not to do. In light of recent events and conversations, I am compelled to speak up about two practices that were born of a blend of convenience-seeking and a lack of awareness about how quickly technical errors can ensnare even the best-intentioned agency leader in an exorbitant civil rights lawsuit.
I’m not going to just throw up a flare. Instead, imagine me standing on the side of the road, waving my hands in the air and jumping up and down, shouting: “If you get away with it, you’re just lucky, and as everyone in our profession knows, ‘Luck is not a strategy.’”
First
The notion of activating community paramedicine systems via of dispatch came up during the 2023 National Association of Mobile Integrated Healthcare Providers in New Orleans. The subject comes up often because it is rational to use CAD to identify who could be best cared for using a non-transport model.
After all, one can look back at the call list and align it with a roster of past patient care record (PCR) to see how often XYZ patient within the community called for service—and how often it was not a bona fide emergency.
When I hear the suggestion, however, I have to hold back from shouting: “No! Don’t!” Folks look at me strangely. Of all the things to get animated about, CAD integration seems fairly vanilla because almost every ePCR system provides this feature. What problem could possibly come from enhancing a function that is so intimately tied to the daily workflow of fire, EMS and police?
Quite a bit, it turns out. CAD feeds into ePCRs and other alerting software are used to kick-start response, not determine that one isn’t needed—or worse, predict what might occur during any given call. Such prediction is a problem because about 19.7% of medical dispatches are marked as “sick person”…which means, basically, nothing.1
(To be clear, the problem here is not the lack of a dispatch reason. “Sick person” is another way of saying “the patient has a problem.” Sure…maybe? What if the passed-out patient is just sleeping really deeply? Or experiencing an overdose? Or dead? The reason is so generic that no one knows what to expect until the crew arrives on-scene.)
A Miscellaneous Catchall
Therefore, triggering a Community Paramedicine response alone using an indicator in CAD is a disaster waiting to happen, and I consider it a point of professional pride to have dissuaded some of America’s best-known CP programs from what could have been a major community relations problem—especially when one considers that CP/MIH and co-response tend to focus on the underserved.
According to a CNN Report in 2019, “Many times a welfare check involves a medical emergency, an elderly person living alone or a relative who is difficult to get ahold of.”
I have been challenged to find actual stats regarding the number of calls for non-emergency care that avoided an emergency transport (the stuff of too many Community Paramedicine programs)—which makes sense, because how can one possibly know if the patient would have needed a transport, or if the patient would have refused transport.
All one can know is what actually happened, and what should have happened based on the facts. John Roberts, Chief Justice of the U.S. Supreme Court, himself has said that emergency care is a core expectation of every person living in America so if a flag in CAD determines that any other response should be activated in response to a call for help, one is asking for trouble.2
Even if 99.99% of the time, the call relates to something non-emergent, what if this time, the patient fell down the stairs, had a heart attack, got stabbed, or the person who is usually the subject of the call is not even involved?
When Lawyers and News Crews Appear
The fact that the location is usually…anything…is irrelevant to the fact that a medical emergency may have occurred this time. You’ll have to explain why you slow-rolled to a place where suddenly no one will remember most calls have been non-emergent, inappropriate, or even fraudulent.
When news crews and the lawyers show up, you want to be able to say that you treated this patient just like every other patient—because that’s what the U.S. Supreme Court says all patients deserve.
A safer alternative is to send two units to the scene—one ready for emergency service, the other specializing in more traditional MIH—namely, the true embodiment of co-response, even within one agency!
It might cost you more money to have multiple units initially on-scene, but optimizing distribution (e.g., staging sites) can reduce the time and fuel required to reach the scene. The two units will evaluate which modes of engagement is most appropriate, and the other can quickly return to service.
Time saved on-scene, especially if the patient does not need to be transported—coupled, and this is important, with liability avoidance, and the ability to prove that addressing the patient’s needs was able to set (or keep) the patient on the straight and narrow, and the opportunity to leverage the relationship built between the CP/MIH crew and the patient—justifies the multi-unit response (after all, “the first month, and particularly the first two days after overdose, is the highest-risk period).3
The cost of rolling two units does not hold a candle to the long tail expenses that are being avoided by all parties, coupled with the ability to get paid for outreach work you are likely already doing, and community goodwill that will pay for itself during future budget cycles.
Second
Calculating risk versus convenience is a real discussion that does not happen enough in Mobile Medicine. It goes beyond clinical practice to data practice, too. Allow me to be starkly clear: Using pass-through credentialing models like Active Directory or Single-Sign-On are not worth the risk to your organization.
Is it reasonable to worry that a medic, firefighter, community paramedic or agency leader could accidentally click in a spammy email and divulge the contents of their inbox, including the passwords that they use to access the contents of their phone, email and bank? Is there a chance that the same password also logs into their ePCR?
Systems like Active Directory provide convenience when managing personnel at scale, such as the thousands of personnel who come and going from large municipal or multi-state private agencies; personnel who are on sick leave or who retire, along with new cadets, people getting promoted, and more. It seems convenient to layer on solutions used by other aspects municipal infrastructure to keep track of things like payroll and timesheets, even access to the building.
Here’s the Rub
Health data are special, not only when one considers the sensitivity of the contents of any given record, but also the fact that violations of healthcare data privacy carry their own fines.
Are extra steps required to force an administrator to appropriately and diligently credential everyone who will access the agency’s ePCR, the EHR, the HIE, etc.? Of course it’s inconvenient! Convenience can transform one into a sitting cyber duck that doesn’t realize it until post-breach.4
Just wrap your imagination around a headline from mid-October 2023, in which one company that powers many single sign-on conveniences “shed more than $2 billion from its market valuation since the company disclosed a hack of its support systems Friday.”5
The stock price drop reflects the question of whether this organization will be trusted with such sensitive data in the future. The fine for a HIPAA violation can be as much as $100,000 per incident.6
Multiply that by just 1001 patients—still a small agency!—and you are already over a million dollars in potential fines. Now ask yourself whether heightened security is worth a bit of administrative inconvenience—not to mention the chance to eschew negative press and the long-term bite of highflying insurance rates.
References
1. V3 911 CALL COMPLAINT DASHBOARD. Nemsis. Accessed 2023 Dec 14. Available from: https://nemsis.org/911-call-complaint/
2. Most powerful (and expensive) health care law you’ve never heard of. East Bay Times. 2013 Nov 13. (Accessed 2023 Dec 14). Available from: https://www.eastbaytimes.com/2013/11/21/most-powerful-and-expensive-health-care-law-youve-never-heard-of
3. Weiner, Scott & Baker, Olesya & Bernson, Dana & Schuur, Jeremiah. (2019). One-Year Mortality of Patients After Emergency Department Treatment for Nonfatal Opioid Overdose. Annals of Emergency Medicine. 75. 10.1016/j.annemergmed.2019.04.020.
4. CISA, HHS Release Collaborative Cybersecurity Healthcare Toolkit. Cybersecurity & Infrastructure Security Agency. 2023 Oct 25. (Accessed 2023 Dec 14). Available from: https://www.cisa.gov/news-events/news/cisa-hhs-release-collaborative-cybersecurity-healthcare-toolkit
5. Goswami, R. Okta cybersecurity breach wipes out more than $2 billion in market cap. CNBC. 2023 Oct 23. (Accessed 2023 Dec 14) Available from: https://www.cnbc.com/2023/10/23/okta-hack-wipes-out-more-than-2-billion-in-market-cap.html
6. HIPAA violations & enforcement. American Medical Association. Accessed 2023 Dec 14. Available from: https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement
More from Jonathon S. Feit
Cultivating Mobile Integrated Health as a Line of Business
Fear and Desperation Can Lead to Risky Long-Term Decisions
If Mobile Medical Money Did Grow on Trees, Would Agencies Realize They Can Reach It?