6-9-05 Sanjeev Arora, MD Greg Blackwell Steve Steinberg M.D. Christine Oesterbo, BSN

1. 6-9-05 • Sanjeev Arora, MD • Greg Blackwell • Steve Steinberg M.D. • Christine Oesterbo, BSN • Joseph Scaletti, PhD • Eileen Sullivan, MLIS • Suzanne Shannon, MS • Dale Alverson, MD

2. MISSION The mission of Project ECHO is to develop the capacity to safely and effectively treat chronic, common and complex diseases in rural and underserved areas and to monitor outcomes. Supported by Agency for Health Research and Quality grant 1 UC1 HS015135-01

3. Hepatitis C: A Global Health Problem Far East Asia 60 M Eastern Europe 10 M Western Europe 5 M United States 3-4 M Southeast Asia 30-35 M Africa 30-40 M Americas 12-15 M Australia 0.2 M 170 to 200 Million (M) Carriers Worldwide World Health Organization. Weekly epidemiological record. 1999;74:421-428.

4. HEPATITIS C IN NEW MEXICO • Estimated number is greater than 32,000 • Less than 5% have been treated • Without treatment 8,000 patients will develop cirrhosis between 2010-2015 with several thousand deaths • 1978 prisoners diagnosed in corrections system (expected number is greater than 2400) - None treated • Highest rate of chronic liver disease/cirrhosis deaths in the nation

5. HEPATITIS C TREATMENT Good News: Curable in 45-81% of cases Bad News: Severe side effects – anemia, neutropenia, depression

6. HEALTHCARE IN NEW MEXICO • 2179 allopathic and osteopathic physicians with active practice • Of 1914 who responded to survey 80% practice in an urban or mixed population density area • 20% practice in rural or frontier areas New Mexico Physician Survey 2001

7. PROJECT ECHO • University of New Mexico School of Medicine Dept of Medicine (Arora, Oesterbo, Scaletti) and Telemedicine (Alverson) • NM Department of Corrections (Pullara) • NM State Health Department (Simpson, Stewart) • Indian Health Service (Santa Fe Indian Hospital-Dave Kuhl) • Community Providers with interest in Hepatitis C New Mexico Physician Survey 2001

8. METHOD • Use Technology (telemedicine and internet) to leverage scarce healthcare resources • Disease Management Model focused on improving outcomes by reducing variation in processes of care and sharing “best practices” • Case based learning: Co-management of patients with UNMHSC specialists • Centralized database HIPAA compliant to monitor outcomes New Mexico Physician Survey 2001

9. INTERACTIVE VIDEO SITES IN NEW MEXICO HEALTHCARE IN NEW MEXICO Connectivity Map

10. STEPS • Train providers, nurses, pharmacists, educators in Hepatitis C • Install protocols and software on site • Conduct telemedicine clinics – “Knowledge Network” • Initiate co-management – “Learning loops” • Collect data and monitor outcomes centrally • Assess cost and effectiveness of programs

11. COMMUNITY PARTNERS • No cost CME’s and Nursing CEU’s • Professional interaction with colleagues with similar interest – Less isolation with improved recruitment and retention • A mix of work and learning • Obtain HCV certification • Access to specialty consultation with GI, hepatology, psychiatry, infectious diseases, addiction specialist, pharmacist, patient educator

12. HEALTHCARE IN NEW MEXICO BUILDING BRIDGES State Health Dept Community Health Centers Private Practice UNM HSC Hepatitis C Diabetes Asthma

13. ROLE OF KNOWLEDGE NETWORK Increasing Gap Medical Knowledge Learning Capacity Time “Expanding the Definition of Underserved Population”

14. ECHO Telemedicine Clinic HIPAA General Aspects • All Telemedicine Clinics contain video, audio and in person participants. • No patients are present. Provider to Provider consult only. • Due to the Research and Educational nature of project ECHO there are many participants who do not “need to know” the patients identity. • Technical Staff • Outcomes Research Staff • Medical Students, Treating Providers and others with education needs.

15. Identify HIPAA Risks • A patients identity could be given to non “need to know” personal. • Physical risks – Clinic rooms could be a source of accidental or intentional “eavesdropping”. • Technical risks – Audio and Video connections could be unsecured. • Protocol risks – Will partnering clinics and organizations agree and implement the same policies in regards to privacy and security.

16. Protocol Solutions • All patient information is de-identified • Patients are presented using identification numbers. • Names, social security numbers or other demographic information is never used to identify the patient. • All participants in a telemedicine clinic will be introduced with their Name, Title and Role. • All sites participating in a telemedicine clinic will have a signed Business Associates agreement. • Details Project ECHO’s HIPAA policies and procedures. • Sites agree to meet or exceed ECHO’s HIPAA policies and procedures.

17. Technical Solutions • To join a telemedicine clinic via telephone, all participants are required to have a password and they are announced in by the operator. • Telephone calls take place on a circuit switched network and thus the communication is inherently secure. • To join a telemedicine clinic via video, all sites connect through a bridge which can allow or disallow a connection. • Video connections come in two flavors; ISDN and IP. • ISDN is a circuit switched network and thus the communication is inherently secure. • IP is a packet switched network and thus is inherently not secure. IP calls must be encrypted!!!.

18. Physical Solutions • Doors to conference locations must be kept shut with a sign stating “Telemedicine Clinic in Progress”. • Telemedicine rooms must provide an adequate sound barrier to prevent intentional or inadvertent eavesdropping. • Cameras for video connections shall show all that are in the room or pan the room during introductions.

20. Prevent Unauthorized Use Deny Unauthorized Access - Participants have different “Need to Know” no patient data (educational outcomes researcher) their patients but not others (rural provider teams) all patient data (UNM patient consultation team) all data without identifiers (learners and researchers) Protect against Network Interception/ Hacking HCV CARE PLAN HIPAA General Aspects

21. Allow access to application through active directory permissions. Password protected screen savers on workstations so timeout occurs on workstation over period of inactivity. Timeout inside application so if user leaves their workstation for period of time, unauthorized user can’t sit down and look at patients. Audit trail/backups so if unauthorized access does occur, we can rollback database and see what was offending user and disable. Prevent Unauthorized Use

22. Encrypted passwords in database so passwords can’t be “hacked”. Site-level access levels so that users are only allowed to see patients from the site they have been given access to by administrator. Isolation of patients by site when data is pushed up to central server so users who are working against “master copy” can only see their patients. Deny Unauthorized Access

23. Encryption on local database if machine is stolen PHI is fully Triple-DES encrypted. VPN encryption for pushing data up to central server Central database triple-DES encrypted so data pushed up follow same security scheme as “sites” Protect Data and Network

24. PROGRESS SO FAR 50 Clinics Conducted Total Number of Case Presentations > 280 (NMCD, IHS, HCNNM, Pojoaque Primary Care El Pueblo Community Health, Las Cruces) > 100 providers have participated 62 Patients Treated (6 completed) 1500 Hours of CME/CE credits issued

25. Conclusion Use of telemedicine, best practice protocols, co-management of patients with case based learning (the ECHO model) is a robust method to to safely and effectively treat chronic, common and complex diseases in rural and underserved areas and to monitor outcomes. Supported by Agency for Health Research and Quality grant 1 UC1 HS015135-01