Despite these inherent benefits, the adoption of cloud-based EHRs varies greatly between. 60 percent of New Jersey’s regional extension center enrollees have chosen to deploy their EHR in the cloud, but some 83 percent of Kentucky’s REC members have chosen on-premise solutions. And it’s not because of access: nearly all of the Kentucky physician population has access to the requisite Internet connections and bandwidth needed to deploy a cloud-based solution.
So what accounts for the massive difference in the two populations? Let’s explore four reasons why physicians still hesitate to move to the cloud.
Interoperability
Hospitals had already adopted EHRs before many physician practices began to think seriously about moving their paper documents to a digital platform, not to mention before most vendors began offering remotely hosted products. Factor in that a large number of physicians are becoming hospital employees and moving their practice into a larger integrated health system, and the logic of choosing the same EHR provider as the nearest hospital becomes clearer.
Unfortunately, interoperability is still a major issue across the healthcare landscape, despite Meaningful Use Stage 2 requirements that eligible professionals demonstrate a decent level of compatibility. Consequently, sticking with the same platform as the nearest hospital ostensibly makes interoperability more attainable than trying to convince two different EHR platforms to interface.
While this isn’t a reason for choosing an on-premise installation over a cloud-based program, it might help explain why some areas, such as the previously mentioned Kentucky practices, have such low usage rates for web-based EHRs.
Security
Questions surrounding cloud security (and recent high profile incidents) still give many businesses pause about storing their information remotely. In multi-tenant, public cloud models, this uncertainty is only compounded when large organizations consider the repercussions of losing control or access to critical data.
For healthcare providers, this conundrum is exacerbated due to the severe penalties associated with a HIPAA violation. However, under the new Omnibus ruling, cloud EHR providers are considered business associates rather than conduit organizations. That means that if a data breach were to occur, the vendor would shoulder the same responsibility as the provider. While that might not reassure practices today (after all, their liability hasn’t changed), it will likely lead to a greater emphasis on security and IT education in the near future.
Control
It’s not unusual for physicians to demand control over everything involved in their practice, down to where and how their patients’ information is stored. In fact, a reduction in autonomy has been one of the major complaints levelled at many of the new federal requirements associated with quality measures.
This desire for control extends to EHR customization as well. Although cloud-based platforms offer physicians a great deal of cost savings (especially up front), they are much more limited in terms of customization. For specialists, this is particularly important as they often need to edit templates and tweak modules.
Cloud-based EHRs continue to gain traction, especially with small practices were cost is a significant factor – and in many cases barrier – to implementing an EHR. However, physicians often have very specific standards, and on-premise EHRs still offer more customization than cloud-based services.
Ownership
When physicians implement a cloud-based EHR system, they’re giving the provider control of all their patient data. That’s not necessarily bad – after all, not having to worry about maintaining servers and storage capacity is one reason providers choose cloud programs – but it might worry some hospitals or practices.
For instance, if a healthcare provider decides to switch EHR or EMR vendors in the future, they may be required to pay a fee in order to take their previous data with them. Last year, a Kentucky practice ended up in Federal Court in an attempt to get access to 40,000 patient records their EMR provider was holding hostage.
Of course, not all cloud-based solutions have such rigid contracts, nor do providers often end up in such scenarios. Still, it’s incidents like the one above that keep some practices wary of hosted solutions.
In order to become the de-facto standard, cloud-based EHR and EMR companies will first need to make a push to educate physicians on the best Health IT security practices, and potentially offer free security consultations to individual practices. Finally, companies will need to provide practices with a way to easily download and convert EMR and EHR data, in the case that a provider wishes to switch programs. This last step may be difficult for some EHR vendors to swallow, but will be crucial to building trust with hesitant hospitals and practices.