Biometrics in healthcare further protects clinical data

everythingpossible - Fotolia

E-prescribing of controlled substances works for Hartford HealthCare

After a new state law required healthcare providers to e-prescribe controlled drugs, Hartford HealthCare put in an EPCS system that uses biometric security technology.

E-prescribing of controlled substances is now law in Connecticut, as it is in about a dozen states.

The state mandate, which took effect Jan. 1, 2018, accelerated a move that had already been envisioned at Hartford HealthCare, Connecticut's largest health system, to install a secure system for e-prescribing of controlled substances.

Now, more than 2,000 physicians and nurse practitioners are standardized on Imprivata's Confirm ID, an EPCS system that uses provider identity proofing, two-factor authentication, biometric technology and supervised credential enrollment. Confirm ID complies with U.S. Drug Enforcement Administration (DEA) requirements.

EPCS replaced paper

Before the health system switched to e-prescribing of controlled substances, all DEA-scheduled drugs were prescribed using paper, explained Spencer Erman, M.D., vice president and chief medical informatics officer at Hartford HealthCare.

It was an inefficient way of doing things, largely because clinicians were already e-prescribing noncontrolled drugs via auto-signed fax straight from the Epic EHR, but had to print scripts on paper for scheduled drugs and then manually sign them, Erman said.

"With these paper prescriptions, there were a lot of concerns -- fraud, forged prescriptions. All that stuff was very real," Erman said.

Spencer Erman, M.D., Hartford HealthCareSpencer Erman

After Connecticut lawmakers passed the EPCS law in June 2017, Hartford HealthCare had six months to find and install a system for e-prescribing of controlled substances.

The health system formed a search committee and considered three vendors before settling on Imprivata, a health IT security vendor whose systems work with EHRs and e-prescribing networks such as Surescripts.

Single sign-on is biometric and smartphone-based

One of the reasons executives liked Imprivata, Erman said, was that Hartford HealthCare was already using the vendor's single sign-on desktop virtualization system and had a HIPAA business associate agreement with the company in effect.

With these paper prescriptions, there were a lot of concerns -- fraud, forged prescriptions. All that stuff was very real.
Spencer Erman, M.D.chief medical informatics officer, Hartford HealthCare

The health system decided to go with Imprivata's biometric fingerprint identification setup in high-traffic areas such as emergency and surgery departments, which ended up translating into about 200 pieces of hardware.

Erman said he would have liked more biometric systems, but they're expensive.

"We didn't have it in our budget to do it. We are going to be doing more of it as time goes on," he said.

For non-biometric sign-in, clinicians use a tokenized smartphone system with two ways for prescribers to sign in and verify their identities.

There's a Bluetooth option in which the EPCS sign-in pops up on the phone automatically, asking if the prescriber wrote a controlled substance prescription. If so, the prescriber can electronically click to confirm their identity.

If a prescriber is off Wi-Fi, he or she can open the Imprivata app on their phone and enter a six-digit number that has been produced by the app's random number generator. That number confirms the prescriber's identity and syncs up automatically with Epic and allows the clinician to send the electronic prescription.

Hartford HealthCares' most intensive EPCS users, about 2,000 prescribers, were enrolled in the Imprivata system in a two-stage process that includes in-person registration using a picture ID and registering inside Epic with a special security code.

Half a year into the project, Erman said most Hartford HealthCare clinicians doing e-prescribing of controlled substances are using the Imprivata system and are finding it convenient. They also think it has potential to reduce the quantity of illegally obtained prescription drugs on the street because of the built-in security, he said.

Technology vs. prescription drug abuse

E-prescribing of controlled substances also lessens the likelihood of illegible prescriptions and exposure of DEA authorization numbers to public view, said Sean Kelly, M.D., Imprivata's chief medical officer.

"The small number of providers running pill mills and illegitimately prescribing huge amounts of [prescription drugs] is causing huge costs in the system for fraud and abuse," Kelly said.

Prescription drug abuse and addiction is "an enormous societal problem and public health epidemic that good technology can help solve," he said.

Dig Deeper on Electronic health record systems

Cloud Computing
Mobile Computing