The spread of COVID-19 has resulted in unprecedented circumstances that have necessitated a shift toward adopting infrastructure for telemedicine, due in large part to the inaccessibility of traditional care services and high exposure risks of in-person healthcare visits. With the increased strain and demand on traditional medical resources, telemedicine has emerged as an essential component of clinical care delivery and many healthcare organizations are reporting substantial increases in telemedicine use. For example, 1 medical center in New York City saw an increase in urgent care virtual visits from a pre-COVID-19 average of 102 daily to 802 post-COVID-19 expansion (March 2, 2020–April 14, 2020).1 Despite the numerous barriers to telemedicine, such as educating staff, cost, reimbursement, access to broadband, and patient digital literacy, telemedicine has flourished during the pandemic, forcing implementations that may have taken years without such a catalyst. As we continue this shift to telemedicine, new issues and risks unravel that need to be addressed, particularly in regard to information security and privacy, and ongoing work is needed to ensure that our technology infrastructure provides an environment for safe and effective care delivery. In the US, the Department of Health and Human Services recently lifted several restrictions on communication apps, (eg, allowing the use of popular video conferencing applications, like Apple FaceTime, Facebook Messenger video chat, Google Hangouts, Zoom, and Skype) and increasing the range of services that are billable using telehealth.2 These actions reduced barriers that previously prevented the use of telemedicine services for individuals. Despite these advancements, the substantial information security and privacy concerns surrounding telemedicine cannot be overlooked. For example, Zoom, currently 1 of the most popular video conferencing platforms, has had a 10-fold increase in usage over just a few months including increased use in healthcare, leading to several important privacy considerations, such as intruders joining video conferences or inadequate encryption of communications, leading to the possibility of eavesdropping. Additionally, governmental agencies have warned of increased risk of cyberattacks towards the healthcare sector and organizations doing research on COVID-19.3 Ransomware attacks—a type of cybersecurity threat that involves encrypting data and demanding payment in return for unencryption—have continued unabated during the pandemic, with many targeting hospitals.4 A recent ransomware attack in Germany led to a patient’s death, perhaps the first death in healthcare directly attributable to a cyberattack. Other recent ransomware attacks have included the Illinois Public Health website and a medical testing facility in the UK.3 Successful cyberattacks negatively impact hospital operations, delay access to clinical services, and lead to significant economic loss, all of which would be devastating to organizations already under extraordinary economic and clinical strain. Protection against these threats to secure telemedicine platforms is complex, and requires a multi-disciplinary, multi-stakeholder approach. Awareness is an important first step, and can take the form of education, employee training, and simulated cyberattacks (eg, sending fake phishing emails and providing training for those who click) toward establishing a culture of security. Recent research in hospitals shows that among several personal characteristics and organizational conditions, employees’ workload had the strongest impact on the rate of clicking on phishing links.5 While extensive emailing of announcements may be needed to keep employees up to date during the pandemic, it could unnecessarily add to workload, putting them at higher risk of clicking on phishing emails. Moreover, best-practice security behaviors must be followed—encrypting data, keeping software updated, running antivirus software, using 2-factor authentication, and following local cybersecurity regulations or recommendations. While healthcare organizations and ambulatory practices may initially need to use consumer video conferencing tools, they should transition to an enterprise (healthcare specific) video conferencing product. Enterprise grade software versions may include key security features such as encryption and may offer additional configuration settings that can be standardized for the entire organization, such as requiring a waiting room with every teleconference. Overall, healthcare organizations need to enhance (if not revolutionize) their cybersecurity infrastructure by developing stronger prevention and detection protocols, both administrative and technological. Executives need to be willing to invest fully in cybersecurity throughout the organization. Emerging fields, such as artificial intelligence, the internet of things, and blockchain can also be employed as prevention and detection tools to combat cyber threats more effectively. To leverage these technologies, healthcare organizations need to partner with telemedicine and cybersecurity vendors to understand how to best implement and use their infrastructure and products. While prevention and detection capabilities are essential, healthcare organizations should be prepared with well-defined response plans. Unfortunately, response plans are often ignored or they are not considered as prevention and detection strategies. Response plans that are tested and practiced are required to minimize the negative consequences of an incident and ensure the provision of safe, secure, and reliable health care operations. Ultimately, while healthcare systems should allocate significant resources towards improving telemedicine capabilities, it is up to healthcare delivery organizations to ensure that these new capabilities are safe, secure, and protect patient privacy. Balancing the significant privacy and information security concerns with the enormous potential benefits of virtual care during this pandemic will remain a vital component to our continuously evolving response to COVID-19. None.

OBJECTIVE: Determination of appropriate endoscopy sedation strategy is an important preprocedural consideration. To address manual workflow gaps that lead to sedation-type order errors at our institution, we designed and implemented a clinical decision support system (CDSS) to review orders for patients undergoing outpatient endoscopy. MATERIALS AND METHODS: The CDSS was developed and implemented by an expert panel using an agile approach. The CDSS queried patient-specific historical endoscopy records and applied expert consensus-derived logic and natural language processing to identify possible sedation order errors for human review. A retrospective analysis was conducted to evaluate impact, comparing 4-month pre-pilot and 12-month pilot periods. RESULTS: 22 755 endoscopy cases were included (pre-pilot 6434 cases, pilot 16 321 cases). The CDSS decreased the sedation-type order error rate on day of endoscopy (pre-pilot 0.39%, pilot 0.037%, Odds Ratio = 0.094, P-value < 1e-8). There was no difference in background prevalence of erroneous orders (pre-pilot 0.39%, pilot 0.34%, P = .54). DISCUSSION: At our institution, low prevalence and high volume of cases prevented routine manual review to verify sedation order appropriateness. Using a cohort-enrichment strategy, a CDSS was able to reduce number of chart reviews needed per sedation-order error from 296.7 to 3.5, allowing for integration into the existing workflow to intercept rare but important ordering errors. CONCLUSION: A workflow-integrated CDSS with expert consensus-derived logic rules and natural language processing significantly reduced endoscopy sedation-type order errors on day of endoscopy at our institution.

OBJECTIVE: The study sought to understand the impact of a phishing training program on phishing click rates for employees at a single, anonymous US healthcare institution. MATERIALS AND METHODS: We stratified our population into 2 groups: offenders and nonoffenders. Offenders were defined as those that had clicked on at least 5 simulated phishing emails and nonoffenders were those that had not. We calculated click rates for offenders and nonoffenders, before and after a mandatory training program for offenders was implemented. RESULTS: A total of 5416 unique employees received all 20 campaigns during the intervention period; 772 clicked on at least 5 emails and were labeled offenders. Only 975 (17.9%) of our set clicked on 0 phishing emails over the course of the 20 campaigns; 3565 (65.3%) clicked on at least 2 emails. There was a decrease in click rates for each group over the 20 campaigns. The mandatory training program, initiated after campaign 15, did not have a substantial impact on click rates, and the offenders remained more likely to click on a phishing simulation. DISCUSSION: Phishing is a common threat vector against hospital employees and an important cybersecurity risk to healthcare systems. Our work suggests that, under simulation, employee click rates decrease with repeated simulation, but a mandatory training program targeted at high-risk employees did not meaningfully decrease the click rates of this population. CONCLUSIONS: Employee phishing click rates decrease over time, but a mandatory training program for the highest-risk employees did not decrease click rates when compared with lower-risk employees.

OBJECTIVE: To investigate the effects of adjusting the default order set settings on telemetry usage. MATERIALS AND METHODS: We performed a retrospective, controlled, before-after study of patients admitted to a house staff medicine service at an academic medical center examining the effect of changing whether the admission telemetry order was pre-selected or not. Telemetry orders on admission and subsequent orders for telemetry were monitored pre- and post-change. Two other order sets that had no change in their default settings were used as controls. RESULTS: Between January 1, 2017 and May 1, 2018, there were 1, 163 patients admitted using the residency-customized version of the admission order set which initially had telemetry pre-selected. In this group of patients, there was a significant decrease in telemetry ordering in the post-intervention period: from 79.1% of patients in the 8.5 months prior ordered to have telemetry to 21.3% of patients ordered in the 7.5 months after (χ2 = 382; P < .001). There was no significant change in telemetry usage among patients admitted using the two control order sets. DISCUSSION: Default settings have been shown to affect clinician ordering behavior in multiple domains. Consistent with prior findings, our study shows that changing the order set settings can significantly affect ordering practices. Our study was limited in that we were unable to determine if the change in ordering behavior had significant impact on patient care or safety. CONCLUSION: Decisions about default selections in electronic health record order sets can have significant consequences on ordering behavior.

Clinical decision support (CDS) systems are prevalent in electronic health records and drive many safety advantages. However, CDS systems can also cause unintended consequences. Monitoring programs focused on alert firing rates are important to detect anomalies and ensure systems are working as intended. Monitoring efforts do not generally include system load and time to generate decision support, which is becoming increasingly important as more CDS systems rely on external, web-based content and algorithms. We report a case in which a web-based service caused significant increase in the time to generate decision support, in turn leading to marked delays in electronic health record system responsiveness, which could have led to patient safety events. Given this, it is critical to consider adding decision support-time generation to ongoing CDS system monitoring programs.

Usability testing is increasingly being recognized as a way to increase the usability and safety of health information technology (HIT). Medical simulation centers can serve as testing environments for HIT usability studies. We integrated the quality assurance version of our emergency department (ED) electronic health record (EHR) into our medical simulation center and piloted a clinical care scenario in which emergency medicine resident physicians evaluated a simulated ED patient and documented electronically using the ED EHR. Meticulous planning and close collaboration with expert simulation staff was important for designing test scenarios, pilot testing, and running the sessions. Similarly, working with information systems teams was important for integration of the EHR. Electronic tools are needed to facilitate entry of fictitious clinical results while the simulation scenario is unfolding. EHRs can be successfully integrated into existing simulation centers, which may provide realistic environments for usability testing, training, and evaluation of human-computer interactions.

OBJECTIVE: To compare the functional capabilities being offered by commercial ambulatory electronic prescribing systems with a set of expert panel recommendations. DESIGN: A descriptive field study of ten commercially available ambulatory electronic prescribing systems, each of which had established a significant market presence. Data were collected from vendors by telephone interview and at sites where the systems were functioning through direct observation of the systems and through personal interviews with prescribers and technical staff. MEASUREMENTS: The capabilities of electronic prescribing systems were compared with 60 expert panel recommendations for capabilities that would improve patient safety, health outcomes, or patients' costs. Each recommended capability was judged as having been implemented fully, partially, or not at all by each system to which the recommendation applied. Vendors' claims about capabilities were compared with the capabilities found in the site visits. RESULTS: On average, the systems fully implemented 50% of the recommended capabilities, with individual systems ranging from 26% to 64% implementation. Only 15% of the recommended capabilities were not implemented by any system. Prescribing systems that were part of electronic health records (EHRs) tended to implement more recommendations. Vendors' claims about their systems' capabilities had a 96% sensitivity and a 72% specificity when site visit findings were considered the gold standard. CONCLUSIONS: The commercial electronic prescribing marketplace may not be selecting for capabilities that would most benefit patients. Electronic prescribing standards should include minimal functional capabilities, and certification of adherence to standards may need to take place where systems are installed and operating.

OBJECTIVE: Electronic prescribing (e-prescribing) may substantially improve health care quality and efficiency, but the available systems are complex and their heterogeneity makes comparing and evaluating them a challenge. The authors aimed to develop a conceptual framework for anticipating the effects of alternative designs for outpatient e-prescribing systems. DESIGN: Based on a literature review and on telephone interviews with e-prescribing vendors, the authors identified distinct e-prescribing functional capabilities and developed a conceptual framework for evaluating e-prescribing systems' potential effects based on their capabilities. Analyses of two commercial e-prescribing systems are presented as examples of applying the conceptual framework. MEASUREMENTS: Major e-prescribing functional capabilities identified and the availability of evidence to support their specific effects. RESULTS: The proposed framework for evaluating e-prescribing systems is organized using a process model of medication management. Fourteen e-prescribing functional capabilities are identified within the model. Evidence is identified to support eight specific effects for six of the functional capabilities. The evidence also shows that a functional capability with generally positive effects can be implemented in a way that creates unintended hazards. Applying the framework involves identifying an e-prescribing system's functional capabilities within the process model and then assessing the effects that could be expected from each capability in the proposed clinical environment. CONCLUSION: The proposed conceptual framework supports the integration of available evidence in considering the full range of effects from e-prescribing design alternatives. More research is needed into the effects of specific e-prescribing functional alternatives. Until more is known, e-prescribing initiatives should include provisions to monitor for unintended hazards.