Mid-Atlantic Health Law TOPICS

1. The Maryland Health Care Commission (MHCC) has conducted an assessment of health information technology diffusion among acute care hospitals in Maryland. The assessment reviewed hospital implementation of electronic health record technology, electronic prescribing (e-prescribing), patient portals, health information exchange, telehealth, population health management tools and mobile applications. The assessment found that: (1) all Maryland acute care hospitals have implemented a patient portal; (2) all but 12 Maryland acute care hospitals have adopted e-prescribing; and (3) more than three quarters of Maryland acute care hospitals report using data analytics to support population health management.

2. The MHCC also conducted a cybersecurity assessment of Maryland acute care hospitals. That assessment reviewed cyber maturity, cybersecurity readiness, cyber liability insurance, vulnerability scanning, penetration testing, incident response planning and employee awareness and education. The MHCC found that: (1) almost all hospitals in Maryland report making at least moderate improvements to their cybersecurity programs over the past two years; (2) only about a quarter of all community-based hospitals, as opposed to nearly all health system hospitals, conduct more than one security risk assessment annually; and (3) less than one-third of all hospitals conduct vulnerability scans on a monthly or quarterly basis.

3. The MHCC and the Chesapeake Regional Information System for our Patients (CRISP) have been exploring opportunities to broaden a CRISP image exchange pilot. The pilot was designed to increase access to images available through the CRISP Query Portal. However, following a review of the pilot, the MHCC found that hospitals have concerns over the cost of a CRISP image exchange, and until such cost issues are addressed, CRISP should defer expanding its image exchange pilot.

    

Barry Rosen
410-576-4224 • brosen@gfrlaw.com