Right now, there’s a good chance a cybercriminal wants to break into your practice. Emails are being sent in the hope one of your employees will click on a link that will install ransomware, hackers are exploiting security flaws in medical equipment with internet connections, and information is being gathered from social media to trick staffers into revealing patient or financial records.
	Even if you own a small practice, chances are you’re being targeted. As a result, physicians must be more vigilant than ever to protect their patient data. Our cover story in this issue explains the three major ways hackers will try to breach your cyber defenses.
	Cybercriminals have many resources and are highly knowledgeable about how technology works and its vulnerabilities, experts say. But they also tend to take the path of least resistance, meaning the harder they have to work to hack a practice, the more likely they are to move on to an easier target. As the bad guys refine their tactics, practices must continue to be vigilant, especially against the most common threats. 
	“You can’t just throw your arms up and say there’s nothing that can be done,” Rob Tennant, the director of health information technology policy for MGMA, told our editors.
	Speaking of risks, in this issue we also examine other risks that physicians deal with in their career, including the malpractice threat, and speak to experts about how to mitigate those risks, and secure the financial future of both yourself and your practice.
	In addition, this issue features articles covering:
	Practical tips for engaging with patients during an exam;
	The latest in solutions for patients for dealing with chronic pain; and
	An interview with a researcher on how primary care has lost its way, and what can be done to reclaim it for physicians and patients.
	As always, if you have feedback on our content, story ideas, or would like to contribute to Medical Economics, please reach out to our editors at medec@mmhgroup.com. 

Mike Hennessy, Sr.
	Chairman and Founder of MJH Life Sciences

Articles

Right now, there’s a good chance a cybercriminal wants to break into your practice. Emails are being sent in the hope one of your employees will click on a link that will install ransomware, hackers are exploiting security flaws in medical equipment with internet connections, and information is being gathered from social media to trick staffers into revealing patient or financial records.

Chairman's letter: How to defeat the cyber threat

Any talk about cybersecurity in healthcare will undoubtedly cover one or more of a hacker’s favorite tactics: Ransomware, phishing, or exploiting poor device security.
	
	While none of these threats are new, they continue to pose major risks to medical practices, partly because they are often not taken seriously enough by practice owners who think they will not become a target, according to experts.
	
	“For hackers, money is the motivation,” says Kevin Haynes, chief privacy officer for Nemours Children’s Health System in Orlando, Fla. Hackers want patient’s health records because they can use them to order medical supplies or bill payers for services that weren’t provided.
	
	A younger patient’s social security number might be used for years for fraudulent activity before anyone realizes it’s been compromised. “Small practices don’t have the same tools to manage risk, but they do retain personal information that can make cybercriminals money,” says Haynes.
	Audrius Polikaitis, CIO of UI Health in Chicago, says that health records are one of the hottest commodities on the black market, with a single record able to fetch $200 to $300, compared to $15 to $20 for a credit card number. “For anyone who maintains health records, we all face the same risks and challenges,” says Polikaitis. “From a small practice perspective, there is no reason to think that your records are any less valuable than those from a university or larger health system.”
	
	A practice’s vulnerability to hackers can create a risk for business disruption, a loss of reputation if a breach occurs, or even hefty HIPAA fines if health records are compromised.
	
	“As larger organizations improve their defenses, I think there is a distinct possibility that hackers move downstream to smaller practices,” says Polikaitis. “Like a house, if someone wants to break in to your network, they’ll find a way. You just need to make your house less attractive to thieves than your neighbor’s.”
	
	Experts say practices can reduce their risk of being hacked by taking some basic preventative measures and educating staff on the most common threats.
	
	


	
	Ransomware receives a lot of publicity because it has crippled some high-profile health systems and government agencies in the last several years. When ransomware hits a network, all its files are encrypted and held hostage, effectively shutting down the organization until either a ransom is paid-usually in Bitcoin-to release the files, or backup files are brought online to replace the encrypted ones.
	
	“Ransomware seems to have died down slightly, but that doesn’t mean it’s something a practice doesn’t need to be vigilant about,” says Rob Tennant, director of health information technology policy for the Medical Group Management Association. “The most important thing is to make sure you have a very good backup system. If you had to shut down your server and start from scratch, it wouldn’t be pleasant, but it wouldn’t affect patient care, and that’s critical.”
	
	“The bottom line is that when you suffer a ransomware attack, you only have two options to get your data back-have an up-to-date backup of your affected systems or pay the ransom,” says Cesar Cerrudo, chief technology officer at IOActive, a Seattle-based cybersecurity firm.
	
	“Unfortunately, despite the wave of ransomware attacks, many hospitals and medical practices still don’t have a good backup policy, making paying seem like the easiest and cheapest option.”
	
	Haynes says that while ransomware is still the biggest threat, staff awareness and software that identifies and blocks attacks are starting to have a tangible effect. Polikaitis agrees, noting that while detection and technology that isolates malicious attachments are improving, having backups is still vital.
	
	


	
	Many of the biggest cyber threats are delivered directly to a physician’s or staff member’s inbox via email. Attachments with malicious code only require the recipient to click on a link to activate software that might do anything from launching a ransomware attack to stealing financial information stored on a server.
	
	For hackers, the biggest challenge is getting someone to click on the link, and the best way they’ve found to do that is through what’s known as phishing: pretending to be a trusted source so as to not arouse suspicion. Several years ago, the attempts were easier to identify, because the emails often had misspellings or looked unprofessional and not work related.
	
	“Now, they are getting more sophisticated,” says Tennant. “There are no misspellings, the tone is right, and the sender’s email address looks legitimate.” Emails might also include logos or other branding information to add legitimacy.
	
	It’s these advanced phishing attempts that worry Polikaitis the most, because the average person won’t necessarily be suspicious. “The real good emails are where someone has taken the time to look at the organization and the person,” Polikaitis says. “Relationships are their favorite angle to use. Two years ago, there was an email that made it look like a CFO was sending their direct report requests for things. Whoever sent it took the time to understand that relationship.”
	
	Serious hackers will take the time to study staff lists on web pages and look at profiles on social media, including LinkedIn, where they can learn more about an organization’s hierarchy. With that information they can construct an email that looks like it’s from a person in charge and direct it to someone who might ordinarily receive emails from that person.
	
	“The bad guys expect that people are busy and won’t pay too much attention, and that they have more email than time and are just ripping through them,” says Polikaitis.
	
	“Unfortunately, smaller practices don’t have the same security tools to warn users and social engineering is becoming easier to exploit due to consumers freely sharing their personal details publicly,” says Haynes.
	
	There are strategies practices can use to lower their risks from phishing attacks. “If you have someone on staff that is an IT expert and you’re not sure about a message, send it to them to take a look,” says Tennant. “Don’t open or click on attachments that you are not sure about. If the person included a phone number, call them and ask them to verify.” Pay attention to details like return email addresses and pause to think whether a request makes sense. “If a message doesn’t look right, assume the worst.”
	
	Haynes says using a third-party email provider, such as Office 365 or Google, can help reduce the number of phishing emails that get through to a practice.
	
	


	
	Connected medical devices offer yet another path of attack for hackers.
	
	If a medical device, no matter how innocuous, is connected to the internet, it is potentially vulnerable to hackers, experts say. “Connected devices are a whole new concern,” says Polikaitis. “We all want the devices to output data so it can be collected and used for daily patient care or research, but if they are connected, the bad guys can get in and do nefarious things.” An IV pump could have its rate changed, or an image could be altered to show a tumor-or have the evidence of one removed.
	
	“You need a list of security questions to ask your vendors,” says Tennant. He advises asking them about how the devices are protected, what are their vulnerabilities, what should be done if they are hacked, and if there are backups to any critical information. The practice also needs to consider how to provide continuity of care if a device is compromised.
	
	Polikaitis says that vendors may claim the devices are FDA-regulated, and therefore they can’t update anything. “The vendor may try to hide behind that, but it isn’t true,” he says. For older devices with little security, vendors need to go back and look at how the devices were installed and reconfigure them to offer the most protection possible.
	
	


	
	Cyberthreats are varied and constantly evolving. Each time an effective defense is developed, hackers find a new way to exploit a network vulnerability. While this cycle of measures and countermeasures is being waged across the globe, doctors just want to take care of patients and not have to be  cybersecurity experts on top of their other responsibilities.
	
	Experts say that the best defense a practice can use is continual education and reminders to staff about the dangers of clicking on links in emails and how to identify ones that may be phishing schemes.
	
	“We do mock phishing attacks three to four times a year,” says Polikaitis. “We send them out and see who clicks on them and then follow-up with education.” There are companies who can provide this service to practices who can’t do it in-house.
	
	He says it is important not to approach the process in a punitive manner, but to keep pushing the educational aspect, even if the results are disappointing at times. For example, Polikaitis sent a fake phishing email with a link to 6,000 health system employees asking for usernames and passwords. About 600 clicked on the link and 150 provided their username and password.
	
	“Despite all our educational push, we still got a fraction that gave up their credentials,” he says. “I’m still amazed people fall for that, but continual education is important.” If the same people continue to click on dangerous links despite being warned not to, then the physician or practice administrator will have to assess whether that person is worth the risk they are introducing to the practice.
	
	“It’s the human being that’s indispensable, but also introduces the greatest risks to the organization through what they do,” Polikaitis says.
	Training and reminders should occur throughout the year. “A lot of practices look at training as something they do in January, then that’s it,” says Tennant. “People are on their own for the rest of the year. It needs to be a continual outreach to the staff.” All regular communications to employees, such as a newsletter or weekly meeting, should include cyber hygiene tips to remind everyone of the risks. “It also emphasizes the importance of the issue to the organization,” he adds.
	
	Haynes says education is the easiest low- or no-cost way to stop hackers. “Spend more time on keeping the medical  practice staff aware of threats and vulnerabilities on the systems they use every day-the internet, email, and phones.”
	
	As technology continues to change healthcare, the cyber risks will always be there. “It’s part of the cost of living in a connected society,” says Polikaitis. “There are a lot of benefits to sharing data between institutions, but there is a cost to it and new risks are introduced with sharing of that data.”

Any talk about cybersecurity in healthcare will undoubtedly cover one or more of a hacker’s favorite tactics: Ransomware, phishing, or exploiting poor device security.

Defending against the cyber threat

We’ve come a long way in medicine over the last decade, but the struggle to merely access quality health services for the 15 to 20 percent of patients who live in rural areas across the United States remains real, leading to frustration and serious health consequences.
	
	The good news is, recent surges in telehealth deployments from healthcare organizations around the country are providing a pathway to better and more accessible care, especially for people in rural areas.
	
	Ultimately, the greatest impact will be realized when providers can convince their patients and the community at large of the benefits of virtual care-to do things like engage a specialist or simply ensure on-demand access no matter how far a patient may be from a provider.
	
	Here are four best practices to consider when developing a rural telehealth strategy.
	
	


	
	When the health system Avera sought to implement a telehealth solution, it hoped to provide support for multiple use cases beyond urgent care and enable patient access via multiple end-points (e.g., mobile, web, kiosk) to ensure a high-quality online care experience-one that would encourage patient participation and engagement.
	
	Putting the patient experience first through telehealth enabled Avera to grow. Since launching AveraNow in the summer of 2015, Avera has seen patient enrollments and visits increase.
	
	

2 Tailor telehealth to patient preferences


	
	The best way to secure buy-in from patients is to design a telehealth program that caters to their specific needs. For example, 67 percent of patients ages 55 and older are willing to try virtual care for chronic care visits, according to American Well’s Telehealth Index: 2019 Consumer Survey. Practices that see a high number of seniors, therefore, need their telehealth platform to support chronic care management.
	
	For middle-aged patients, on the other hand, emphasizing the ability of telehealth to support prescription renewals is key, given the fact that 42 percent of consumers ages 45 to 54 who use mobile health apps rely on pharmaceutical apps, according to the same survey.
	
	


	
	If cost is a barrier to implementing telehealth, look for opportunities to partner with health plans that are already using telehealth. More and more health plans are investing in telehealth and encouraging their provider partners to collaborate and use telehealth as part of value-based contracts.
	
	When health systems are willing to partner and bring concrete success metrics to demonstrate ROI, health plans are eager to collaborate. Working directly with a health plan’s telehealth solution also gives providers the opportunity to test the waters before investing in their own technology.
	
	


	
	Patients requiring care from a variety of providers are greatly challenged in rural areas, especially when providers are not located near one another.
	
	Collaborating with specialists to streamline healthcare by offering consultations through a single platform ensures patients get the care they need in a timely, efficient manner while dramatically expanding the breadth of services available for in rural areas.
	
	


	
	Historically, limited access to high-speed internet has been a barrier to telehealth implementation in rural communities. But access to high-speed broadband Internet is growing. As rural healthcare organizations embrace telehealth, now is the time to consider what is needed to create a value proposition for rural residents and physicians that improves quality, stretches limited resources and elevates care across the continuum.

The struggle to merely access quality health services for the 15 to 20 percent of patients who live in rural areas across the United States remains real, leading to frustration and serious health consequences.

Reaching rural patients through telehealth

Increasingly, payers are adopting a take it or leave it approach in contracts with physicians in the value-based marketplace, putting physicians in a tough spot. What can physicians do to show their value and increase their power in negotiations?
	
	Experts say physicians will have to get creative, by partnering with health plans to achieve common goals, and finding ways to grow market share-and leverage.
	
	“It helps if you can position yourself as a partner versus a vendor,” says Joe Caruncho, JD, CEO of Genuine Health Group in Miami, Fla., a management company that helps physicians make the transition to value-based care.
	
	


	
	Caruncho says that physicians can achieve that partner status and increase their value by figuring out what the health plan’s strategic initiatives and focus are, and by offering to help the health plan achieve some goals in exchange for a better rate or shared profits.
	
	“These days they’re competing on quality measures,” Caruncho says. “It’s not about [which payer] can provide the cost for the cheapest, it’s about who can increase their four-and-a-half-star plan in the market and get the best reputation. That’s how they compete for membership.”
	Then, he says, the physician and the payer can work together to share in either cost savings or added revenues that result because the physician helped the plan increase its ratings, and as a result, its physicians may be getting more money from Medicare and/or more patients.
	
	Caruncho describes this idea of treating the physician payer partnership as “a paradigm shift” from simply expecting payers to pay money for services to one of joining forces with the payer to achieve better results, higher quality, and reduced costs.
	
	“Having a relationship with a health plan where you share in the profits is a lot more lucrative while also practicing great medicine.”
	
	Joe Wagner, director of BRG’s Healthcare Performance Improvement practice, in San Francisco, Calif. agrees. “One thing physicians can do is to demonstrate the ability to improve or work on quality measures that are important either to a commercial payer or to the government,” he says.
	Wagner says this can be done through such means as analytics that identify through their care experience patients that are important for outreach, and patient navigation hubs that direct patients to the right services.
	
	“Patient navigation hubs allow the provider to do outreach with identified patients, where the physician dedicates resources to the important quality measures, schedules appointments based on those measures the program deems are important to quality care of patients and then conducts those services so you actually improve the overall care that’s been delivered,” Wagner explains.
	
	


	
	There are other scenarios where physicians may already have greater leverage than they realize or could build leverage through redesigning their practices.
	
	“Plans need to be compelling to their purchasers, namely individuals and employers. If a health plan is missing a provider that makes it [not] compelling, it may not be very viable in the marketplace,” says Adam Powell, Ph.D, president of Payer+Provider Syndicate, a management advisory and operational consulting firm in Boston, Mass.
	
	In some instances a provider may have one of several advantages. First, he says, the provider may be so highly regarded in a community that it would be difficult for the payer to attract patients to their plan without that provider network.

He cites the example of Tufts Medical Center in Boston, which is so well regarded an insurer would have trouble selling its plans without keeping Tufts in network.
	
	Second, a provider may have what Powell calls a “local monopoly,” which often happens in rural communities where there aren’t as many options, or a provider who is one of a very few offering a specialized service within a certain area.
	
	In that case, Powell says, a health plan is likely to be compelled to contract with the provider because the payer needs to have access to their services in the domains with the monopolies.
	
	Substantial market share gives the provider leverage, Powell says, because if that organization leaves the network due to failed negotiations with the payer, “Then all those members are going to have to change their family physicians, internists or PCPs and they’re not going to be happy,” he says.
	
	Since not all physician practices are going to meet either of these criteria, he says, another option is to merge with another provider organization in order to obtain a larger market share.
	
	He says that many of the small physician practices that haven’t gone out of business as a result of such pressures have been absorbed by larger entities, though the downsides are real, including loss of control over how medicine is practiced.
	
	“If you have people merging their practices into group practices, there’s better coverage,” Powell says. “Probably more modest incomes, but also more modest expectations.”
	
	


	
	Lower reimbursement amounts and tough negotiations with payers are pushing more physicians to practice differently in general, says Andria Jacobs, chief operating officer at PCG Software, which develops healthcare applications focused on cost containment, fraud and abuse detection, based in Las Vegas, Nev.
	
	“It’s a tough environment for physicians,” she says, based on polling done by such groups as the Medical Group Management Association. “Now we have so few payers it’s an oligopoly, and the health plans have all the power. Physicians are really unhappy.”
	
	They’re also unhappy with the demands of managed care, from the authorization process to quality improvement measures and frustrations with their electronic health records.
	
	As a result, she’s seeing physicians either retiring or selling their practices to group practices, or having to get creative.
	
	“My OB/GYN now offers additional services not covered by insurance to make ends meet because she wants to be in solo practice,” Jacobs says. Simply taking what insurers pay is no longer enough.
	
	Other doctors are moving more toward direct pay and concierge options. Jacobs’ own physician has a membership program that ranges from $500 to $1500 per year that gives patients quicker and more consistent access to him.
	
	“Otherwise he can’t stay in business,” she says. “You can’t run your practice like you did in the past where there was always enough money coming in,” Jacobs says.
	
	


	
	If negotiations with payers stall or remain unsatisfying, the best option is to offer direct pay services to patients, either on the side or as part of a direct pay practice, says Paula Muto, MD, a surgeon in private practice outside Boston. Muto founded UBERDOC, a direct pay, direct access healthcare platform.
	
	“Doctors should realize who the payer actually is. It is no longer the employer as the burden of payment has dramatically shifted to the patient because of high deductible plans. The patient is the payer,” she says.
	
	With patients facing increasingly higher deductibles they often don’t meet in a given year, she sympathizes with their frustration at also receiving bills from their physicians. She believes that price transparency will bring an alternative to the system especially for lower cost routine care, leaving insurance for bigger, more catastrophic services.
	
	“We need to think differently,” Muto says. “I’m very excited about bringing the doctor and the patient back together.”

Increasing value when negotiating with payers


	
	Before I notified a payer that I wanted to renegotiate, I gathered meaningful data, including how much they were paying us as a percentage of our charges and how that compared to our other commercial payers. Sharing this data with them gave me powerful ammunition, and the confidence to call their bluff.
	
	

Tell them what makes your practice special


	
	To a giant commercial insurer, your small practice is just one of many they contract with. They are not going to know what makes you special-and why they should pay you more-unless you show them.
	
	I told this payer about their sponsored quality initiatives in which we participate. I emphasized the specific recognitions we had received for quality care from their organization and the fact that we are the only family practice in a 15-mile radius that is an in-network provider for their product.
	
	In addition, I took what may have been perceived as negotiating weaknesses-our size and location-and tried to turn them into advantages. I pointed out that small, rural practices like mine are important to employers outside of major metropolitan areas, and these employers often have strong loyalty to their community and local physician practices. Treating my clinic well creates a favorable impression among those employers and increases business for the payer.
	
	

Don’t be afraid to ask for what you need, or want


	
	In my experience, most physicians are willing just to “go with the flow.” They want their professional relationships to be simple and non-confrontational. So when a payer presents them with a contract and tells them nothing in it is negotiable, they sign. This is a big mistake.
	I recall a talk from a contract lawyer during the practice management part of my residency. He said there’s no such thing as a non-negotiable contract. You can always do an addendum or rider. It never hurts to ask. The worst they can say is no.
	
	


	
	A payer may not be able to negotiate some items due to corporate policy or regulatory restrictions, but they might be able to make a change in another part of the contract that will make up for it. A negotiated agreement is seldom going to end up exactly the way you want it to. The trick is to know when it’s good enough, and how much the time spent in additional negotiation is worth to you.
	
	


	
	Negotiating major payer contracts can be very anxiety-provoking. At times, I have felt that if I lost a contract my entire practice could fail. But there is nearly always an alternative, and if you haven’t discovered what it is, then you shouldn’t be negotiating yet.
	
	


	
	I’m not friends with the provider network person I negotiated with, but our relationship was cordial and business-like. Negotiating shouldn’t be emotional, but removing emotion from the process takes practice. 
	
	

Melissa Lucarelli, MD, is a family physician, medical director and owner of Randolph Community Clinic, a rural primary care clinic in South Central Wisconsin. She is a member of the Medical Economics Editorial Advisory Board.

Payer negotiating tips

In physician practices, there are multiple billing pitfalls that threaten practice revenue. For every 10 physicians who provide care in the United States, nearly seven people provide billing support. Nationally, providers spend $282 billion per year on billing and insurance-
	related costs-and half of these costs are considered excessive, a recent study found.
	
	But too often, practice leaders fail to spot these revenue traps. The result: low cash collections, higher-than-necessary billing costs, and threats to patient satisfaction.
	
	Where do hidden billing costs typically exist-and how can practice leaders more effectively rein them in? Here are four common blind spots.


	
	This is the starting point for billing support, and it’s rife with inefficiency. Manual transactions take 10 minutes to perform, on average, and some last as long as 23 minutes. Yet while most providers have adopted electronic eligibility and benefits verification, this billing process remains the single biggest savings opportunity for medical providers to reduce administrative costs, at $3.4 billion.
	
	Making the switch to electronic eligibility and benefits verification is about more than administrative efficiency. It can also reduce denials rework-especially when eligibility checks are run again prior to claim submissions to ensure patients’ coverage is still active. Registration and eligibility errors are the root cause of one-third of denials.
	
	


	
	Manual claim status inquiries are the costliest of any administrative billing expense tracked by the Council for Affordable Quality Healthcare (CAQH). Why? Manual inquiries require 14 minutes of staff time, on average, to complete, according to the 2018 CAQH Index. Electronic claim status inquiries, on the other hand, take just five minutes to complete. As a result, the savings opportunity in moving from manual to electronic status inquiries totals $2.6 billion among medical providers.
	
	


	
	Given the impact out-of-pocket estimates have on practices’ ability to engage patients in the cost of their care, practice leaders should consider:

Investing in tools that calculate patients’ out-of-pocket costs at the point of registration

Training front-end staff to have financial discussions with patients prior to the point of service

Equipping physicians with cost information so they may engage in cost discussions with patients


	
	For physician practices, cash posting is tedious, highly manual, and relegated to entry-level staff. It takes staff significantly longer to process paper-based check payments than electronic payments, according to an Association for Finance Professionals report. Paper checks also are five times more expensive to receive than e-payments. But the inefficiencies associated with manual payment posting result in more than lost productivity and higher transaction costs. They also threaten practice revenue-especially when errors in posting strangle a practice’s ability to follow up on underpayments. Patient loyalty also is put at risk, such as when errors in manual posting prompt staff to pursue higher balances than necessary.
	
	These are just some of the reasons why automating cash posting makes financial sense for medical practices. It’s an approach that also provides real-time visibility into payments, streamlines remittance advice management, more quickly identifies opportunities to better manage denials, and reduces the costs associated with medical billing. One specialty practice saved 13 hours per day by automating its cash-posting processes, increasing productivity and freeing up staff to focus on more value-added activities.

Where do hidden billing costs typically exist-and how can practice leaders more effectively rein them in? Here are four common blind spots?

Rein in hidden billing costs

The electronic health record (EHR) has become the third wheel in the exam room, often getting in the way of physicians making meaningful connections with their patients.
	
	“Both as a physician and on the receiving end as a patient, I have found that EHRs absolutely can cause certain barriers,” says Johnny Dias, DO, an internist with the Medical Group of the Carolinas in Spartanburg, South Carolina. “By starting to type in the computer, you can feel the disengagement from the patient.”
	
	Payer documentation mandates have forced doctors to rely too much on the computer during exams, says Jack Ende, MD, MACP, an internist in Philadelphia, Pennsylvania and former president of the American College of Physicians. “We are in an age now where we are being required to over-document so we can demonstrate we’ve done things so we can get paid for them, and that’s all part of the problem,” Ende says.
	
	But while finding the right balance between thorough documentation and a successful patient encounter may be difficult, it’s not impossible, physicians say. It requires understanding the doctor’s own style of conducting visits and the quirks of their software and exam rooms, not to mention a good dose of pre-planning and staff support.
	
	


	
	While everyone these days can become absorbed in their electronic devices, in a patient exam it’s up to physicians to control the dynamic. A 2015 study in the International Journal of Medical Informatics that tracked the eye movements of doctors and patients during exams found that patient gaze and eye contact followed cues from the physician.
	
	In other words, physicians must establish eye contact and create an inviting, engaging atmosphere for the patient.
	
	Each physician needs to learn their best way of managing the EHR during patient visits. Ende, for example, says he never types on a computer during patient examinations and instead jots a few notes while focusing on the patient. “I will take a history for a new patient the old-fashioned way: with a pad of paper on my lap, making good eye contact and being able to appreciate the patient’s body language,” he says.
	
	He enters lab orders, billing information and other such data into the computer, but typically dictates the narrative portion of the patient note to a staff member. Ende, who is also professor and assistant dean at the Perelman School of Medicine at the University of Pennsylvania, admits that’s a rare method for today’s physicians but says it’s the way he feels he can best connect with the patient.
	
	Melissa Lucarelli, MD, a solo family physician in Randolph, Wisconsin, says that before she walks into the exam room she studies the patient’s data and history to make sure she has the basic knowledge she needs to avoid relying on the computer. Also, she will copy-and-paste patient history information in her EHR to get a head start on the note before the upcoming encounter.
	
	“Ideally, your EHR would become invisible, but what I’ve set for myself as the sort-of gold standard for the computer in the room, is to make it as unobtrusive as a paper chart,” says Lucarelli, a member of the Medical Economics editorial advisory board.
	
	Lucarelli uses laptops on carts in her practice, which lets her position herself to look the patient in the eye regardless of the layout of the exam room.
	
	Dias works in a similar way, doing as much prep work as possible before walking into the room so that he can focus on connecting with the patient. He studies the patient’s history, including what preventive care screenings the patient needs and what lab orders or tests are likely, based on the patient’s conditions.
	
	“You are essentially walking into the appointment with some good background knowledge and really already knowing what you want to do,” he says.
	
	


	
	The EHR need not be a barrier: It’s also a tool to potentially increase patient engagement.
	
	The 2015 study found that when physicians look at the computer, the patient’s gaze usually follows. The study’s authors describe this moment as a chance to use the EHR as a “shared artifact,” meaning a way to gain the patient’s attention. What happens next in such instances can either be a missed opportunity or a way to gain the patient’s trust.
	
	“When physicians share information visually from the EHR monitor, patient satisfaction and patients’ involvement in the decision-making process improves,” the authors write.
	
	Lucarelli says she uses data and charts in almost every visit to show trend lines for weight, hemoglobin A1C and other types of discrete and trackable data. In other words, it uses technology to bring the patient into the encounter.
	
	“I’ll show it on the computer and say: ‘Good job, your weight is down.’ I used to be flipping back and forth, looking at their weight at the last appointment. Now we can look at the trend for the last year. That’s the sort of thing the EHR does well,” she says.
	
	Ende typically uses charts and graphs on his EHR near the end of the patient appointment, and says it’s an excellent teaching tool that shows the potential of technology for patient-centered care.
	
	Those instances when you can bring the patient into the medical record are very helpful,” he says. “The availability of the data right there has been a real plus.”

Experts offer best practices to balance the burden of data entry with the necessity of making connections

Keeping focus  on your patients

Medicine is a team sport-the collective is often much greater than the individual when it comes to patient care, innovative ideas, productivity, and efficiencies. Even more important is that effective teamwork leads to fewer medical errors.
	
	Bearing in mind that not all teams are created equal, below are some strategies worth considering to get the most from your team.
	
	


	
	When people all agree on a common purpose and feel that they are all working towards that purpose, there is a greater sense of camaraderie and teamwork. Reminding people of that common purpose (i.e. patient care and comfort) helps them feel a sense of meaning and significance and helps break down and/or avoid silos. It is critical for teams to understand that success is best defined by achieving your purpose In other words, it is more about team success than individual success.
	
	


	
	One of the most common traits of successful teams, is that they have established norms by which they agree to operate under. Here are some questions I typically use when helping teams develop their agreements:

What are the behaviors we need from each other to develop greater trust?

How do we ensure that everyone’s voice is heard?


	
	When team members clearly understand each other’s roles and responsibilities, they can then find opportunities to help each other out. I often ask healthcare teams how they define success at the end of their day. My objective is for them to see that their work is all about the best interest of patient care, and that includes helping out our colleagues when needed. Establishing a common set of metrics helps to define success and ensure that the team is able to measure their progress. The ability to achieve goals not only boosts team morale and reinforces the team mission, it also helps the team to identify factors that contributed to their success. When goals are not achieved, it allows the team to discuss strategies that might be more effective.
	
	


	
	Teams that learn together, bond together. It is critical, especially in a health-care setting, that mistakes are seen as an opportunity to learn and improve, versus an opportunity to shame and blame. The team agreements should address this issue. You want people to openly discuss errors and near misses so that they can continually improve patient care and safety. A culture of continuous improvement among a team means that everyone knows that mistakes are bound to happen and that the best thing that can come from them is learning.
	
	

5 Provide opportunities for the team to get to know each other on a more personal level.


	
	One great way to do this is through a personality workshop. It is a perfect opportunity to learn about people’s different styles, preferences, communication behaviors, and ways they might be misunderstood. It can lay the foundation for ongoing sharing, a key element for teams to develop psychological safety.

Strategies worth considering to get the most from your team.

5 ways to build a better medical team

Amid speculation that malpractice insurance rates will rise, maintaining an air-tight risk management plan should be on doctors’ agenda this year.
	
	Malpractice insurance rates declined over the last decade as tort reform and industry safety measures led to fewer claims, but the size of the largest claims is growing. This could lead to higher rates in the future, experts say.
	
	“It’s not widespread, but we’re finally beginning to see some upward pressure on [malpractice insurance] rates,” says Chad Karls, FCAS, principal and consulting actuary for Milliman, a Brookfield, Wis.-based actuarial and consulting firm. The examples are spotty geographically, but primary care practices are among those at higher risk, he says.
	
	A 2017 study of hospital professional liability by consulting firm Aon and the American Society for Healthcare Risk Management projects no increase in the number of claims below $2 million for 2018, but a 2 percent rise in claim severity. The study also noted “early signs” of a rise in the number of claims above $5 million, but the data weren’t conclusive enough to quantify the increase.
	
	Also on the rise, the report found, are so-called batch claims, or multiple claims resulting from a repeated behavior. One example: improperly sterilized equipment.
	
	Karls still expects liability insurance rates to stay favorable for another couple of years, but there are some signs of changes ahead. Increasing demand for more electronic records and safeguarding patient privacy could spur a rise in the number of claims.
	
	Internists, in particular, could see higher rates as claims centered on failure to diagnose rise, Karls says. These types of claims often can take a long time to surface as more is learned about how a disease progressed, so he urges doctors to be sure they are working with a highly-rated carrier.
	
	Beyond taking care when choosing a carrier, practice owners should stay vigilant in maintaining their risk mitigation strategies, he says. And that involves protecting a doctor’s personal finances from excess professional liability as well as those of the practice.
	
	“Large hospital systems today have whole risk management teams to do investigations and implement policies,” says Craig Brodsky, JD, a partner with law firm Goodell DeVries in Baltimore, Md. “The question is how to put that type of system in place at a smaller practice without breaking the bank.”
	
	


	
	Physicians should start by taking advantage of the built-in resources available through vendors, Brodsky says. Liability insurers typically offer some risk mitigation reviews as part of their contracts or provide more comprehensive services for a fee, and many offer discounts if physicians attend risk-mitigation seminars.
	
	Primary care doctors, in particular, need to be aware of some newer types of risks, he says. Mandatory use of EHRs increases their exposure to possible security and data breaches. Greater use of telemedicine raises the possibility of more diagnostic errors. Practice mergers and rising numbers of non-physician practitioners can chip away at the close personal relationship doctors used to have with their patients, and studies show patients are more likely to sue providers they don’t know well.
	
	The renewed focus on sexual harassment in the workplace also poses a risk that a practice’s attorney should address through written policies and procedures, says Brodsky.
	
	Fees for these services vary depending on the size and scope of the practice. Another route to explore, particularly if budgets are tight, is to see whether a practice’s admitting hospitals offer risk-management audits or similar services to affiliated physicians.
	
	


	
	Physicians should be aware that those hospital affiliations, along with other agreements, can lead to certain conflicts of interest, experts say. Doctors in a small group practice, for example, often have contractual arrangements with other entities for providing care or procuring services. These arrangements can leave a practice, or an individual physician, exposed from a liability standpoint.
	
	In the Aon study, 61 percent of hospital providers were moderately or extremely concerned about vicarious liability from non-employed physicians, and 73 percent said they require those physicians to carry between $1 million and $2 million in coverage.
	
	As more primary care physicians have become employed by or affiliated with hospitals, a possible outcome could be more large claims, as plaintiffs’ attorneys seek deeper pockets, says Erik Johnson, regional director for Aon Global Risk Consulting and author of the report.
	
	As a result, it’s essential to understand the professional liability implications of the agreements, experts say. Often, a large network will move to settle claims quickly, for example, when an individual doctor might be better off disputing the claim to clear their professional record.
	
	“Doctors still have an individual interest and they need to be aware that a business entity is not going to look out for their interests,” says John Lyddane, JD, a partner with law firm Dorf & Nelson LLP in New York. Negotiating an independent attorney or liability insurer as part of an employment agreement is the best way to avoid those conflicts ahead of time, he says.
	
	Frequently, joint practice agreements will spell out how legal claims will be handled, and the arrangements typically are meant to serve the organization, not necessarily to get the best outcome for an individual doctor. “In a sense, [physicians] really can’t just go hire their own representation  because the contract itself says you are agreeing to their risk management system,” Lyddane says.
	
	If a group decides to settle a malpractice case instead of going to trial, for example, the physician named in the suit has to live with the repercussions of having his or her name and the incident (plus any monetary settlement) in the National Practitioner Data Bank. This, in turn, can lead to denials for participation in certain healthcare plans, Lyddane says. It could also affect a physician’s employability and likelihood of receiving hospital admitting privileges.
	
	


	
	Practice consultants routinely chide physicians for not documenting courses of action that they recommend to patients. This lack of documentation can be problematic in lawsuits, but limiting it to a chart entry isn’t always sufficient, either.
	
	If a primary care physician, for example, refers a patient to a specialist but the patient doesn’t go, the physician can be held responsible in a lawsuit if there was no follow-up with the patient or the specialist, Lyddane says.
	
	Lyddane often recommends that referring physicians follow-up directly with the specialist to confirm that a patient was actually seen and the results of the visit were added to the primary care physician’s record.
	
	And physicians must remember to incorporate phone and email conversations into the record as well, Lyddane says. An electronic message trail is better than no trail at all to document a physician’s orders, but if the order never makes it into the official record, it can be a problem, he says.
	Copying and pasting previous notes in the EHR when seeing a patient with a recurring problem is another mistake from a liability standpoint, he says, as any inaccurate information in those passages then gets repeated in newly-created notes. For each visit, physicians should make a new electronic record, he says.
	
	


	
	The use of ancillary services, physician assistants, and nurse practitioners is another factor to consider in risk management, experts say.
	Vicarious liability, or the responsibility of a physician for the actions of subordinate providers, is an important part of assessing a practice’s overall risk profile, says Ingrid Hubbard Reidy, vice president of risk management for ISMIE Mutual Insurance Company, a Chicago-based medical liability insurer.
	
	Some states require written collaborative practice agreements covering the scope of work performed by non-physicians, she says, and all providers should have documentation of staff members’ credentials and continuing training. And be aware that state laws covering these arrangements are changing frequently, she adds.
	
	Even among physicians, other types of documentation are crucial, she says. For example, when practices don’t have access to their patients’ data from admitting hospitals, it creates a significant liability risk.
	
	Many physicians today are so accustomed to EHRs that they don’t think about picking up a phone to inform a colleague about a patient, she says. So if a specialist is not connected to the primary care provider via the EHR, the primary physician can be left completely unaware of a patient’s progress.
	
	Care coordination poses another potential risk, particularly for primary care physicians, Reidy says.
	
	“It’s in the handoffs of care that we’re missing a lot of things,” she says. “Many of the large health systems are doing a good job within the confines of their own system with this, but it’s a real challenge for [doctors] not in the system. Sometimes, [primary care providers] don’t even know their patient is in the hospital. They’re really struggling with that and it provides a lot of risk for them” because they don’t know to ask questions about their patients’ most recent medical encounters.
	
	Sometimes, simply asking a patient if they’ve seen other physicians since their last office visit is an effective way of catching errors of omission in the information trail, she says.
	
	Another risk mitigation tool is the human element. As medical groups get bigger and more corporate, the deep personal relationships formed between patients and doctors are under siege, Reidy says.
	
	One way providers can counter this trend is by sharpening their communication skills. Be very clear with patients about the diagnosis and treatment plan at hand, she says. Making sure to educate patients and then having them acknowledge that they understand what they need to do to comply with the plan is crucial, she says.
	
	


	
	While relatively few malpractice awards exceed physicians’ insurance limits, it’s important to consider personal assets when thinking about protection against liability claims.
	
	Employer-sponsored retirement accounts generally are protected from claims and a 401(k) or 403(b) plan carries the most  protection of all from creditors because they are protected by federal labor law.
	
	Individual Retirement Accounts (IRAs) have fewer protections than employer plans in non-bankruptcy liability cases, though state laws vary.
	Some states offer strong protections for IRAs against creditor claims, says Richard Naegele, JD, an employee benefits attorney with Wickens, Herzer, Panza, Cook & Batista Co. in Avon, Ohio. California, on the other hand, leaves wide discretion to judges as to how much money within an IRA can be included in a malpractice award.
	
	And in some states, SEP-IRAs (designed for the self-employed) are not protected from claims, he says. Physicians with funds in these accounts should discuss it with their financial adviser.

Amid speculation that malpractice insurance rates will rise, maintaining an air-tight risk management plan should be on doctors’ agenda this year.

Managing physician risk in a costly world

As the opioid crisis continues, physicians need the most appropriate tools to combat the opioid crisis, including medication-assisted treatment (MAT).
	
	But do they have access to them? And are there enough of these front-line caregivers with the tools they need to help people suffering from an opioid addiction?
	
	


	
	Medication-assisted treatment, or MAT, involves the use of certain medications, along with counseling and other behavioral therapies to treat addiction. Buprenorphine is one of the three FDA-approved medications used in MAT, according to the Substance Abuse and Mental Health Services Administration (SAMHSA).
	
	Currently, access to this kind of treatment is a challenge for patients across the country, says Mohammad Zare, MD, associate professor and vice chair of community services in the department of family and community medicine at McGovern Medical School at The University of Texas Health Science Center at Houston (UTHealth) and the chief of staff of ambulatory care services in the Harris Health System. That includes Houston, where the methadone clinics can’t handle the volume of patients with an opioid use disorder.
	
	In fact, improving access to treatment and recovery services and promoting the use of overdose-reversing drugs are two of the U.S. Department of Health and Human Services’ five top priorities in responding to the ongoing opioid crisis.
	
	But clinicians can’t just prescribe buprenorphine whenever they want to. They must have a special waiver, certifying that they’ve completed a relevant training course.
	
	The federal Drug Addiction Treatment Act of 2000 requires healthcare practitioners to apply for a waiver in order to prescribe or dispense buprenorphine as a treatment for an opioid use disorder. They have to start by conveying their intent to apply for a waiver to the SAMHSA Center for Substance Abuse Treatment.
	
	Currently, physician applicants must provide proof that they’ve completed an eight-hour training course, plus their DEA number and their state medical license number, to be eligible to apply for a first-time waiver.
	
	Zare is the co-site principal investigator of a site in Houston that’s part of the national Primary Care Opioid Disorders  study, a clinical trial designed to examine which strategies can increase buprenorphine prescription rates in primary care settings.
	
	Zare’s team is testing out a collaborative care approach called the Massachusetts Model. They’re comparing one clinic with a clinical nurse manager to support three waiver-trained primary care providers against a control clinic without that additional support. They hope to find out if that support can expand the number of patients they’re able to see and treat in a primary care setting. 
	
	The goal: to find an approach that reaches more people who need MAT so they can experience long-term success. “They become more functional. They go back to work again. They start having a job and going back to their families,” says Zare.
	
	


	
	Some suggest that the waiver requirement is a barrier to having more front-line clinicians prepared to provide MAT. But how much of a barrier does the requirement present?
	
	The waiver does set limits on the number of patients for whom a provider can prescribe buprenorphine. But the training course is free, and can be completed at the student’s leisure, notes psychiatrist Michael Mancino, MD, program director of The Psychiatric Research Institute’s Center for Addiction Services and Treatment at the University of Arkansas for Medical Sciences. “That is not a significant barrier,” he says.
	
	Nurse practitioners and physician assistants are eligible for waivers, too. They must complete 24 hours of training, or they can  take the same eight-hour training as physicians, plus an additional 16 hours of training from SAMHSA.
	
	In Arkansas, the number of providers with waivers has grown from 85 to more than 300 over the past few years, according to Mancino. But he says the waiver isn’t the biggest hurdle standing in the way of people gaining access to more waiver-trained clinicians.
	
	“The number one barrier in Arkansas is stigma,” says Mancino.
	
	He explains that some clinicians don’t believe that addiction is an illness-and  thus should not be treated as such. Instead, some still view addiction as a moral failure or the result of a lack of willpower.
	
	Zare agrees that the mindset needs to shift.  “Substance use disorder is a chronic disease,” he says. “We don’t stigmatize someone who has hypertension. We manage it chronically. We need to take patients with substance use disorder and treat them the same way.”
	
	


	
	A recent study in the journal Drug and Alcohol Dependence examined the disparity between opioid overdose deaths and available treatment services in Flint, Michigan. The researchers found that opioid treatment centers were rarely located in the areas where the most overdose deaths occurred.
	
	That’s critical information because it shows where the greatest need lies and illustrates a geographic barrier for people who may want treatment but can’t access it, according to researcher and epidemiologist Debra Furr-Holden, PhD, associate dean for public health integration at Michigan State University and director of the Flint Center for Health Equity Solutions.
	
	The study also illustrates the need for more healthcare professionals who are specialists in addiction medicine, says Furr-Holden.  A generalist with waiver training can be helpful, but having an adequate number of experts with the specialized training and experience is really critical.
	
	“Do you want an orthopedist delivering your baby?” Furr-Holden says. “You want somebody who’s trained. Treating addiction isn’t something that we can just make up as we go along. Our training and medical education needs to catch up to the problem.”

Understand the tools physicians need to combat chronic pain as the opioid crisis continues.

Combating chronic pain

Primary care is in a bad place. Physicians feel undervalued. Cumbersome technology, administrative burdens and payer hassles mean physicians are unable to spend the time they want with their patients.
	
	At the same time, patients have never had more choices for where to get primary care. Hospital systems and private equity are gobbling up practices. Drug store chains are opening clinics, where patients can see a non-physician provider for basic care.
	
	Does this mean the traditional physician-patient relationship is dead?
	
	Timothy Hoff, Ph.D., professor of management, healthcare systems and health policy at the D’Amore-McKim School of Business at Northeastern University, argues that both physicians and patients still want a long-term relationship, but modern healthcare, with all its complexity and focus on value is preventing both parties from forging the caring relationships they would prefer.
	
	This is the case that Hoff makes in his book, Next in Line: Lowered Care Expectations in the Age of Retail- and Value-Based Health, published in 2018 by Oxford University Press.
	
	Hoff sat down with Medical Economics to discuss the state of the physician-patient relationship and what can be done to fix it. This interview has been edited for length and clarity.
	
	

Medical Economics: There is this ideal of the doctor-patient relationship that physicians and patients hold on to. Has it ever really existed?
	
	Hoff

: That’s a fair question. It’s something that we’ve romanticized over time. But I think it’s real, it’s been real, and you can see evidence for it in our own healthcare history, as well as even some of the trends that you see going on right now.
	
	There was a time where we had these doctors called general practitioners, the forerunners of family doctors, when we did have much more relational medicine. That was in part because we didn’t have as much technology to rely on and we didn’t have so many specialists. Back then, many people did have long-standing ongoing relationships with a single doctor, particularly in the primary care area. Those doctors tended to practice in the same communities, they stayed fairly stable over time within a practice.
	
	So those relationships were definitely there. I think it’s definitely been real. I think we do romanticize it for a reason because there’s elements of it that are very real that many people have experienced over time and feel very strongly about.
	
	

ME: How has being a primary care physician changed over the years?

: Primary care has changed an awful lot. I would focus, and the book talks about this, on three major reasons. One is the continued specialization in American medicine, this idea that no one doctor can do it all. And so, increasingly, primary care physicians have had their scope of practice whittled down. For example, they stopped doing hospital care, and were replaced by hospitalists. They stopped delivering babies. So one of the ways it’s changed is the scope of practice continues to get more and more narrow.
	
	Another way it’s changed, and my book really takes aim at this, is primary care is the first brand of medicine that’s really been fully corporatized, and corporatized with this idea I call “metric fever,” which is what I call trying to standardize medicine as much as possible, which has the effect of making it more transactional. That makes it less focused on the squishy or relational elements like the doctor getting credit for talking to the patient. You can’t measure that precisely, so increasingly those things aren’t being valued.
	
	And finally, as healthcare is being consolidated, more primary care doctors now work for large entities with hospitals at the center of them. And hospitals think about primary care very differently than the traditional primary care practice used to. So I think that those are the major ways primary care has changed: narrow scope of practice, standardization and cook-booking of primary care, and doctors who are largely employees of large systems.
	
	

ME: One of the things we hear about a lot is the consumerization of healthcare, that patients are looking at healthcare more like they’re looking at other things that they purchase and consume in their lives. Do you think it’s true patients are looking at healthcare this way?

: Most doctors will tell you that most of their patients still desire the same things from their care and from their interactions with the system as they did 20 or 30 or 40 years ago. Patients want someone who’s an expert, who’s going to listen to them. They want someone who’s going to help them solve the problems they have, they don’t want to feel blown off and they want someone who shows a degree of empathy towards them.
	
	I think a lot of consumerization is being concocted by an industry that’s not being controlled by doctors right now. For big organizations that want to streamline care, the view of the patient as consumer is really the best view to take.
	
	Do patients want more consumer convenience? That’s true. They don’t want to wait three months to see a doctor. They don’t want to have to be put through tons of inconvenience for a primary care visit.
	
	But the expectations of patients are being taken advantage of. This consumer rhetoric comes along that says, ‘Oh, I know your needs are not being met, and we can meet them, and here’s how we’re going to do it.’ But, you know, a lot of that, in my opinion, is snake oil.
	
	

ME: What are your thoughts on the emergence of quick convenient care settings?
	
	Hoff

: There’s a real concerted effort among big healthcare companies and even non-healthcare companies like Amazon, Apple, and Google, to turn the primary care part of healthcare into a cheaper, more transactional form of care delivery-a fast food kind of model. Fast food with the use of technology: that’s the way I would put it. I think it’s a tsunami threatening to disrupt all primary care. There’s government acceptance of this new way of looking at it, there is venture capital acceptance of this new way of looking at it. But I don’t think patient acceptance is there. I think we’re being led to believe it is, but it’s not. But I do worry that, if something doesn’t change soon, you’re going to see a primary care system that looks extraordinarily different from the one we had even 10 years ago, a sort of pop-up franchise, drive-thru kind of system, aided by the use of technology.
	
	

ME: What is the impact of these trends on actual patient outcomes? Are these changes leading to improvement in outcomes for, say, patients with chronic conditions?
	
	Hoff

: The data is underwhelming, let’s put it that way. We’ve invested a ton of money in the use of metrics and the use of measurements, the use of EHRs to document and collect data on patients. And yet the studies that are out there show the quality gains are negligible, particularly given the amount of investment. In other words, we haven’t had this dramatic improvement in outcomes. So, from a quality perspective, none of these new ways of looking at primary care have done the job, and from a cost perspective, the jury’s still out.
	
	

ME: For primary care physicians who feel the deck is stacked against them, what should they do? How can they fight back against these trends?

: When it comes to primary care, it’s important to stress the relational side of medicine, the interpersonal connections that really make the difference. And so we have to pay for that. Doctors have been saying this for years, and I agree with them, that you’ve got to value those aspects more. And we’ve got to acknowledge the fact that to many policymakers and payers, that sort of care looks inefficient. So we do need to invest more in this relational care.
	
	The medical profession itself is going to need to come to a decision about how much primary care doctors matter. I think doctors of all kinds now need to think about new forms of collective mobilization. I don’t use the term unions. They’ve got to find ways to band together-not in the way that they are banding together now. It’s very reactive now. They need to come together to assert their economic power and to advocate for specific things that are going to bring more value to the work that they do.

How the crumbling of the physician-patient relationship lies behind the problems facing primary care delivery

Medical Economics March 10, 2020 edition