healthy4u: Stanford University

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

Case 1. Tumult <blockquote>October 5, 2011 New York Times <a href="http://www.nytimes.com/2011/10/06/us/stanford-hospital-patient-data-breach-is-detailed.html?_r=1">Patient Data Landed Online After a Series of Missteps</a> By KEVIN SACK Private medical data for nearly 20,000 emergency room patients at California’s prestigious Stanford Hospital were exposed to public view for nearly a year because a billing contractor’s marketing agent sent the electronic spreadsheet to a job prospect as part of a skills test, the hospital and contractors confirmed this week. The applicant then sought help by unwittingly posting the confidential data on a tutoring Web site. [Got all that? - ed.] In an e-mail sent to a victim of the breach, the billing contractor, Joe Anthony Reyna, president of Multi-Specialty Collection Services in Los Angeles, explained that his marketing vendor, Frank Corcino, had received the data directly from Stanford Hospital, converted it to a new spreadsheet and then forwarded it to a woman he was considering for a short-term job. The position was with Mr. Corcino’s one-man shop, Corcino & Associates, Mr. Reyna wrote in the e-mail, which was authenticated by his lawyer, Ellyn L. Sternfield. The job applicant apparently was challenged to convert the spreadsheet — which included names, admission dates, diagnosis codes and billing charges — into a bar graph and charts, Stanford Hospital officials said. Not knowing that she had been given real patient data, the applicant posted it as an attachment to a request for help on <a href="http://studentoffortune.com/">studentoffortune.com</a> [I wrote about that earlier <a href="http://hcrenewal.blogspot.com/2011/09/new-way-to-get-kids-interested-in.html">here</a> - ed.], which allows students to solicit paid assistance with their work. First posted on Sept. 9, 2010, the spreadsheet remained on the site until a patient discovered it on Aug. 22 and notified Stanford. </blockquote> My, how electronic data can travel when mishandled. Try that trick with 20,000 paper charts ... <blockquote> The hospital, located on the campus of Stanford University in Palo Alto, demanded that the spreadsheet be removed, and the Web site quickly complied. Pressed for time, the job prospect wound up completing the assignment herself and, in the end, did not get hired, Ms. Sternfield said. </blockquote> Ironically, this was all for naught. <blockquote>Mr. Corcino, in his first public statement, attributed the breach to “a chain of mistakes which are far too easy to make when handling electronic data.” </blockquote> Far too easy to make - especially by the dyscompetent. <blockquote>... Breaches of private medical data have become distressingly commonplace, with two substantial ones disclosed in the last week alone. [We don't know the details of those yet; that's for next week - ed.] </blockquote> Case 2: Pandemonium (from same NYT article) <blockquote>In Orlando, officials with Florida Hospital reported that three employees had improperly combed through emergency department records of 2,252 patients, apparently to forward information about accident victims to lawyers. The employees were fired, and law enforcement officials are investigating. </blockquote> Trolling for Torts - is this a new EMR TV game contestant show? Perhaps it could be followed by "<a href="http://hcrenewal.blogspot.com/2011/02/what-was-this-medical-resident-looking.html">Trolling for Tarts?</a>" Case 3: Bedlam (from the same NYT article) <blockquote>Meanwhile, Science Applications International Corporation disclosed that computer backup tapes containing medical data for 4.9 million military patients [that number also amounts to almost 2% of the total U.S. population - ed.] had been stolen from an employee’s car in San Antonio. The data included Social Security numbers, clinical notes, laboratory test results and prescriptions. The company said the risk of harm was low because retrieving data from the tapes would require specialized knowledge, software and hardware. [Who's to say the theft was not by someone with that specialization, or someone paid by same to steal the tapes? - ed.] The Texas breach is by far the largest since September 2009, when a new federal law began requiring disclosures of medical privacy violations involving at least 500 people. Some 330 such episodes have been tallied, including four others that affected more than one million people each. </blockquote> We'd all be buried in stray clinical paper by now if it weren't for computers. Thank god for them! <blockquote>Officials at the Department of Health and Human Services said the new reporting requirements had exposed deep vulnerabilities and encouraged renewed vigilance. </blockquote> Exposed to whom? The blind, deaf and dumb? <blockquote>“We’re moving in the right direction in terms of a culture of compliance,” said Leon Rodriguez, director of the department’s Office for Civil Rights, which investigates medical privacy cases. “Are there still a lot of problems out there? Yeah, my sense is there are still a lot of problems.” </blockquote> The Titanic was moving in the right direction - towards New York Harbor, in fact, when it met a little unexpected obstacle. Perhaps a culture of brains would be better than a culture of compliance... <blockquote>The Stanford breach was notable for the duration of public exposure, and for spotlighting the vulnerability created by a medical provider’s business relationships with outside parties. Last week, lawyers filed suit in state court in Los Angeles, seeking certification as a class action and $20 million in damages from Stanford Hospital & Clinics and Multi-Specialty Collection Services, which is known as MSCS. </blockquote> $20 million might hurt a bit, and might help motivate the organization to hire better and/or more appropriate clinical information management expertise - in house where it belongs (see below). <blockquote>The threat of liability set off a predictable round of finger-pointing. In written responses to questions, Lisa Lapin, Stanford University’s assistant vice president for university communications, said, “MSCS bears the complete and sole responsibility for the breach.” </blockquote> It's their fault, not ours. <blockquote>Ms. Lapin said the hospital had sent the data in encrypted form to Mr. Corcino, who requested it on behalf of MSCS to analyze a strategy for improving billing collections. She said Mr. Corcino had regularly represented himself as MSCS’s executive vice president and had been Stanford’s “primary contact” during a seven-year relationship. MSCS, a five-person firm that audits hospital accounts to maximize reimbursement, possessed the passwords to unencrypt the data, she said. </blockquote> It was all about money and outsourcing. <blockquote>“This mishandling of private patient information was in complete contravention of the law and of the requirements of MSCS’s contract and is shockingly irresponsible,” the hospital said in a statement. </blockquote> It is foolish to believe that someone else can run critical aspects of your business, and it is even more foolish to believe that it is OK for someone else to run critical aspects of your business. <blockquote>Ms. Sternfield, Mr. Reyna’s lawyer, said Mr. Corcino had never been an MSCS employee, but rather was paid a monthly fee to drum up business, typically in face-to-face meetings with health care executives. Mr. Reyna, she said, had no knowledge that the Stanford data had been sent to Mr. Corcino, or that he had passed it on. Mr. Corcino was not authorized to use an MSCS title, Ms. Sternfield said, but she declined to say whether Mr. Reyna was aware of the practice. She acknowledged that Mr. Corcino sometimes used an MSCS e-mail account. In his e-mail to the breach victim, who shared it with The Times, Mr. Reyna wrote that Stanford had sent the file to Mr. Corcino “for a potential MSCS project that would audit paid accounts to verify that the reimbursement was correct.” For his part, Mr. Corcino said in a statement that he was an independent contractor but was “the marketing face of the company,” and that MSCS “allowed me to use the title of executive vice president.” He wrote: “Stanford sent the file to me at MSCS, and I imported the data into a spreadsheet that was forwarded to the job applicant as part of a skills test. I did not intend to provide any personal health information in the file. This was a marketing project.” Without explaining how or why he sent the data to the applicant, Mr. Corcino said MSCS had not trained him properly and faulted Stanford for sending him private information that he did not need. That, he said, was the “first link in a chain of mistakes.” “I regret that Stanford released a file containing unnecessary information,” Mr. Corcino said, “that MSCS did not have an appropriate training and audit system for the handling of electronic data and that I was not more careful with the file. While Stanford and MSCS left the information in the file I received, it was my mistake to not catch its inclusion and remove the data.” ... The hospital has terminated its relationship with MSCS, and Mr. Reyna has done the same with Mr. Corcino. </blockquote> Even I can't follow all that. This will be one convoluted court case... <blockquote>Stanford Hospital has reassured affected patients that the posted spreadsheet did not contain Social Security numbers, birthdates or credit card numbers, and has offered free identity theft protection services. The hospital said it had not uncovered any misuse of the exposed data. </blockquote> Yet, that is. (Is it no wonder that sedatives are among the most highly-prescribed medications?) Moving from the NYT article: Case 4: Tumult (I'm running out of descriptors) <a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/"></a><blockquote><a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/">A large class action lawsuit again Health Net and IBM</a>: California Legal Westlaw Journal Insurance Coverage Health Net’s, IBM’s negligence compromised medical data, suit says June 7 (Westlaw Journals) - Health Net Inc. and IBM face a class-action lawsuit seeking $5 million in damages over the loss of computer storage devices that held the medical histories, financial data and Social Security numbers of 2 million people. Health Net Policyholder Alana Bournas’ class-action complaint in the U.S. District Court for the Eastern District of California alleges that the insurer and IBM breached their duty of confidentiality and negligently allowed the release of highly personal and confidential information of millions of Health Net employees and policyholders. The complaint alleges violation of California’s Confidentiality of Medical Information Act, Cal. Civ. Code § 56; Cal. Civ. Code § 1798.2, which concerns the unauthorized disclosure of customer records; Cal. Bus. & Prof. Code § 17200, the state’s unfair-competition law; and public disclosure of private facts. </blockquote> Companies will either pay the going price for competent employees, or pay for the mistakes of incompetent ones. It would probably be better for society, however, to do the former habitually. <blockquote>The suit says IBM agreed to manage Health Net’s information technology database for five years beginning in 2008. IBM informed Health Net Jan. 21 that it had lost nine disk drives containing the confidential information of 2 million people, including Health Net policyholders and employees. Health Net failed to alert the victims of the breach until March 14, the complaint says. IBM allegedly also failed to encrypt the data, thereby enabling anyone who possesses the hard drives to easily access the confidential information. This puts the victims at an increased risk of identity theft and “other unauthorized uses of plaintiff and class members’ personal information” the suit says. </blockquote> Encryption, a feature now built into mainstream OS's by Microsoft and Apple? (Oh wait...IBM...) <blockquote> Health Net’s attempt to compensate the victims by providing two years of free credit monitoring services through TransUnion is an inadequate remedy for the defendant’s conduct, Bournas says. This “remedy” fails to address unauthorized disclosures of medical information, and the monitoring services only protect against new account fraud but do not address fraudulent activity with existing accounts, the suit says.</blockquote> These executives apparently can't even get the fix straight. <blockquote>Moreover, the complaint says, Health Net has previously been accused of a similar breach of confidential information. In 2009 it lost the same types of records of nearly 1.5 million people and waited six months before notifying the victims. In settling the state of Connecticut’s lawsuit stemming from that security breach, the company promised “to enhance security procedures and training,” the suit says. </blockquote> What can I say? <blockquote>The current breach could have been avoided had Health Net and IBM taken proper precautions and implemented security policies to maintain consumers’ confidential data, according to Bournas. Therefore, the protections granted under California law require that Health Net be penalized for its negligence, she says. The plaintiff notes that millions of people entrusted Health Net with their private data. “At best, defendants’ actions allowed this private information to go astray. At worst, the private information is being viewed, sold, resold, and used for illegitimate and illegal purposes,” the complaint says. The suit is seeking injunctive relief, compensatory damages, declaratory relief, and attorney fees and costs. Bournas v. Health Net Inc., No. 2_11-CV-01262, complaint filed (E.D. Cal. May 11, 2011).</blockquote> I would revise that to say "The current breach could have been avoided had Health Net and IBM hired personnel in adequate numbers with the qualifications and true gravitas (and not laid them off, of course) to maintain consumers’ confidential data." Case 5: Maelstrom (I am reaching to the bottom of the barrel for such descriptors). <a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm"></a><blockquote><a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm">Wellpoint recently settled class-action suit in CA</a>. AMA news By Pamela Lewis Dolan, amednews staff. Posted Aug. 1, 2011. WellPoint reaches tentative accord in data breach suit It is the second settlement to come from lawsuits claiming that the company failed to protect the privacy of individual insurance applicants online. WellPoint has reached a preliminary settlement that will, if approved, bring an end to a class-action lawsuit filed more than a year ago. The lawsuit, filed in the Superior Court of the State of California, involves the potential exposure of data belonging to more than 600,000 individual health insurance applicants on a company-run website that allowed insurance applicants to track their applications. The situation came to light when an applicant to WellPoint-owned Anthem Blue Cross of California sued the company in March 2010. The applicant was able to manipulate the web address within the site to gain access to other applicants' information, including names, addresses, dates of birth, Social Security numbers and health and financial information. </blockquote> In other words, probably changing a simple number in the URL brought up someone else's records. Good going there, Wellpoint. What were the programmers thinking? (Were they thinking?) <blockquote>When the suit was filed, the company said an upgrade to the system caused the information to become exposed. The company said a third-party vendor validated that all security measures were in place when, in fact, they were not. Changes were made to the system soon after the situation was discovered.</blockquote> Blame someone else, yet again. <blockquote>In addition to the class-action suit, the company was sued by Indiana Attorney General Greg Zoeller in July 2010. The suit, filed in Marion County Civil Superior Court, alleged that the company violated the Indiana Disclosure of Security Breach Act by failing to notify Zoeller, and the 32,051 Indiana residents affected by the incident, in a timely manner. That suit was settled in early July, when WellPoint agreed to pay a $100,000 fine. As part of the settlement, WellPoint admitted it had a security breach and failed to properly notify the attorney general's office as required by law.</blockquote> <a href="http://www.urbandictionary.com/define.php?term=oy%20gevalt">Gevalt</a>. <blockquote> Under the preliminary settlement in the California class-action matter, WellPoint agreed to offer credit monitoring for two years to all affected individuals. Class members are eligible to receive reimbursement for identity theft losses of up to $50,000 per incident, as well as additional time to file identity theft claims until May 31, 2016. Those making identity theft claims are eligible for an additional five years of credit monitoring. The company also will donate a total of $250,000 to two nonprofit organizations whose efforts are directed at protecting consumers' privacy on the Internet.</blockquote> It might have been cheaper and better for goodwill not to outsource a vital function...those third-party vendors can really hurt you. (I'd really like to know - was this "third party vendor" domestic, or overseas?) <blockquote>WellPoint did not admit wrongdoing in the case, nor was it found guilty. A fairness hearing is scheduled for November, and the courts then will decide whether to approve the settlement.</blockquote> Large corporations are immune from such formalities as admitting wrongdoing or being found guilty. ----------------------- But don't worry. <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">Your medical data's safe.</a> Sort of. See also: <ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-emrs-and-healthcare.html">Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue</a>?",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-interoperable-secure-national.html">Networked, Interoperable, Secure National Medical Records a Castle in the Sky?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/01/it-flaws-and-coverups-of-same-why-i.html">Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/10/medical-data-breach-of-week-but-your.html">Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts</a>", </li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/11/insurers-test-data-profiles-to-identify.html">Insurers Test Data Profiles to Identify Risky Clients</a>",</li></ul><ul><li>and <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality">others</a></li></ul> -- SS

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

Case 1. TumultOctober 5, 2011New York TimesPatient Data Landed Online After a Series of MisstepsBy KEVIN SACKPrivate medical data for nearly 20,000 emergency room patients at California’s prestigious…

Đọc thêm »

07 Oct 2011

Quis Custodiet Ipsos Custodes? Redux

Revised HHS Rules for Conflict of Interest Fall Short This morning NIH Director Dr. Francis Collins announced <a href="http://freepdfhosting.com/3dde31520d.pdf">revisions</a> to the existing 1995 regulations on objectivity in research that is funded by the Public Health Service. The focus is on significant financial interests (SFI) and on financial conflicts of interest (FCOI). The regulations illustrate the 3-way dance involving academic institutions (the grantees), NIH (the grantor) and academic scientists (the investigators). Thanks to Senator Grassley (R-Iowa) and his investigator Paul Thacker, headlined revelations in recent years about unacceptable management of FCOI at places like Stanford (Alan Schatzberg), Emory (Charles Nemeroff) and Harvard (Joseph Biederman) forced these revisions of the NIH regulations. The general initial reaction to the new rules has been critical – <a href="http://www.pharmalot.com/2011/08/nih-issues-new-conflict-of-interest-rules/">here</a> and <a href="http://pogoblog.typepad.com/pogo/2011/08/the-national-institutes-of-health-new-ethics-rules-a-swing-and-a-miss.html">here</a>, for instance. Many stakeholders had urged the NIH to require that institutions make the disclosed FCOI of their investigators available on a public website. Dr. Collins had intimated that we could expect to see this change, so there is consternation that it somehow became derailed by institutional lobbying in recent months. The stated concern was that institutions would feel burdened by the need to maintain these data bases. Instead, if citizens wish to inquire about FCOI involving PHS-derived research funding, they will need to write to the institution, which is obliged to respond within 5 days. That’s not exactly user friendly. POGO today made the smart <a href="http://pogoblog.typepad.com/pogo/2011/08/the-national-institutes-of-health-new-ethics-rules-a-swing-and-a-miss.html">suggestion</a> that the data could easily be attached to information about awarded funds on the <a href="http://projectreporter.nih.gov/reporter.cfm">NIH RePORTER</a> website, that already exists. A second failing is that the revised regulations do not close the regulatory loophole through which Charles Nemeroff strolled when he moved from Emory to the University of Miami. We covered that incident <a href="http://hcrenewal.blogspot.com/#uds-search-results">several times</a> on this blog last year. Though Nemeroff was under a 2-year sanction and banned from participating in NIH-funded research at Emory, his friend Thomas Insel, Director of NIMH, assured the dean of the medical school at Miami that Nemeroff was in good standing to apply for NIH funding when he moved from Emory. To underline the point, Insel displayed the bad judgment of appointing Nemeroff to 2 new NIMH review committees. Do today’s revised regulations prevent a repeat of this administrative travesty? No, they don’t. There is some mention of ensuring oversight if a sanctioned investigator wishes to transfer a grant to a new institution, but nothing to prevent the Nemeroff-Insel dance from being repeated. Here is the relevant section of today’s <a href="http://freepdfhosting.com/3dde31520d.pdf">announcement</a> (page 89): We did, however, agree with one respondent that it would be helpful to clarify, in the grants context in particular, that institutional sanctions against an Investigator can travel with the Investigator upon his or her transfer to another Institution. Specifically, we have revised 42 CFR 50.606, paragraph (a), as follows: “If the failure of an Investigator to comply with an Institution’s financial conflicts of interest policy or a financial conflict of interest management plan appears to have biased the design, conduct, or reporting of the PHS-funded research, the Institution shall promptly notify the PHS Awarding Component of the corrective action taken or to be taken. The PHS Awarding Component will consider the situation and, as necessary, take appropriate action, or refer the matter to the Institution for further action, which may include directions to the Institution on how to maintain appropriate objectivity in the PHS-funded research project. The PHS may, for example, require Institutions employing such an Investigator to enforce any applicable corrective actions prior to a PHS award or when the transfer of a PHS grant(s) involves such an Investigator.” This revision is intended to reference the range of options for the PHS Awarding Component to consider, depending on the specific circumstances at issue. For example, PHS may decide to initiate government-wide suspension or debarment of the Investigator under 2 CFR Part 376; or to use enforcement measures under 45 CFR 74.62, e.g., perhaps to make the approval of a transfer contingent upon the former Institution’s disclosure of the corrective action- including the specific sanctions against the Investigator- to the new Institution; and/or to use special award conditions under 45 CFR 74.14, e.g., perhaps to make the new Institution agree to take the same or similar action against that Investigator or explain to the PHS Awarding Component in writing why such action was not taken and what alternative measures will be used to ensure compliance. What’s wrong here? Everything is optional; everything is discretionary; everything is contextual – that is a formula for NIH and the academic institutions to just look the other way. And if a Nemeroff decides just to relocate without transferring a grant then he is free to start reapplying again right away. Miami would not be required to continue applying the Emory sanction banning him for 2 years from involvement in federal grants. The PHS Awarding Component (NIMH in this case) may or may not get involved, or it may pass the buck to the new institution. So what has changed? If it is left up to compromised federal bureaucrats like Thomas Insel, and institutional administrators like Pascal Goldschmidt at Miami, then nothing has changed. It's business as usual, folks. Dr. Collins, you have not done what you set out to do. Too bad.

Quis Custodiet Ipsos Custodes? Redux

Revised HHS Rules for Conflict of Interest Fall Short This morning NIH Director Dr. Francis Collins announced revisions to the existing 1995 regulations on objectivity in research that is funded by th…

Đọc thêm »

23 Aug 2011

IMPEACHMENT: IT’S ABOUT THE INSTITUTION, NOT THE PERSON

IMPEACHMENT: IT’S ABOUT THE INSTITUTION, NOT THE PERSON The impeachment trial of Judge G. Thomas Porteous of Louisiana this week was a lesson in civic ethics. The lessons of the Porteous trial apply to academic medical centers, professional medical societies, medical journals, and granting agencies like NIH. The Porteous trial is a straightforward case of bribes, kickbacks and corruption involving a Federal judge. The most enlightening arguments came from prosecutor Rep. Adam Schiff, D-California, laying out the case for impeachment in the Senate. He gave a lucid presentation of the logic and the historical origins of the impeachment process. The key points are these: impeachment serves to protect the dignity, honor, and credibility of the office more than to punish the wayward office holder; and impeachment is a constitutionally sanctioned way to clean the Augean stables without necessarily having to prove criminal liability. It is sufficient to demonstrate that the bad actors have brought disgrace on their offices. What this means for us in medicine is that legalistic charges and defenses are not the right way to go in exposing and ejecting bad actors from our field. In the highly publicized cases of ethical compromise over the past few years, our group disapproval, when there was any at all, generally has run on two parallel tracks. The first is legalistic, and it favors the bad actors, who flaunt their constitutional protections with the taunt, prove it. The second ground of disapproval is esthetic, based on the tackiness of the bad actors’ behaviors – regardless of technical legalities, what they do is an affront and an insult to professional standards and mores. When we look at how recent incidents in medicine actually played out, however, we see a disconnect. The bad actors have narrowed the debate to the first ground of disapproval, while forcing the second off limits. In this strategy, they have received conscious or unconscious assistance from the professional establishment. The focus has been on legal technicalities involving the bad actors rather on preserving the dignity and credibility of high offices in academic medicine. For instance, when Charles Nemeroff was exposed by Senator Grassley for conflict of interest in his NIH grants, he came up with the contrived legalistic defense that his unreported payments from GlaxoSmithKline were for ‘CME-like’ presentations, and thus somehow exempt from disclosure. Nemeroff’s obfuscations finally collapsed of their own weight and Emory University took decisive action against him, even though they had sufficient evidence dating back at least 4-5 years. In the end, Emory had to go through the wringer to discipline Nemeroff, and the institution suffered grave damage to its reputation for a number of years as the price of delay. For instance, when Thomas Insel, the Director of NIMH, assured Pascal Goldschmidt, Dean of the School of Medicine at the University of Miami, that Nemeroff was absolutely in good standing for applying for new NIH grants if he left Emory for Miami, despite a 2-year ban at Emory, he hewed to the letter of the law while disregarding its spirit in order to help his friend. Moreover, when Insel appointed Nemeroff to two new NIH Research Review Committees, he established beyond any doubt that he was intent on trying to help Nemeroff get back into circulation, and that he failed to grasp the gravity of the dishonor that Nemeroff inflicted on the field. This obtuseness on Insel’s part damaged the credibility and reputation of NIMH. To his credit, NIH director Francis Collins finally ‘got it’ and forced a review of the NIH ethics rules that had been entrusted to Insel. For instance, when Pascal Goldschmidt, Dean of the School of Medicine at the University of Miami, claimed he had done due diligence in his recruitment of Nemeroff as chair of his psychiatry department in 2009, he focused on the legalistic aspects of Emory’s review of Nemeroff, while failing to understand the degree of negative publicity associated with Nemeroff’s name. He ended up hiring someone who is an object of ridicule, and he in turn is ridiculed by association. For instance, when Stanford University learned of Alan Schatzberg’s boundary violations vis a vis his NIH-funded projects and his personal corporation, they first pushed back on legalistic technical grounds. Only later did the Stanford administration get the message by removing Schatzberg from his Principal Investigator role with NIH grants, and eventually appointing a new chair of psychiatry. Meanwhile, the public image of Stanford suffered. For instance, when the American Psychiatric Association was warned that Alan Schatzberg was a problematic candidate for election as President of the association on account of his history of ethical compromise, they went ahead anyway and they have since had opportunity to regret that decision. Here again, the professional society appears to have lost sight of the ethical forest for the legal trees. The credibility and reputation of the APA have suffered because of the taint associated with Schatzberg’s presidency. For instance, when the New York Times recently exposed the ghostwriting associated with the 1999 textbook of Charles Nemeroff and Alan Schatzberg, the so-called authors responded with typical legalistic defenses. They and the University of Miami and the American Psychiatric Association Press (the publisher) again lost sight of the ethical forest for the legal trees. This stereotyped, public relations driven response ignores the visceral and esthetic distaste most observers felt on learning about the collusion between the ‘authors,’ the professional writing company and the sponsoring pharmaceutical corporation. Even the defense that it occurred a long time ago fails. In the Porteous trial, the prosecution established that dishonorable events in an officer’s past are grounds for impeachment, whether or not they also occurred during the person’s time in office. For instance, when Harvard Medical School planned a <a href="http://cme.hms.harvard.edu/cmeups/pdf/03124280.pdf">new CME program </a>on psychopharmacology in mid-2011, they engaged a number of compromised academic speakers, including Nemeroff and Schatzberg. What the hell was Harvard thinking? I told the Course Director, Carl Salzman, that this amounts to pandering. He replied defensively that Nemeroff and Schatzberg are well regarded speakers and that he would ensure that they gave unbiased presentations. That’s not the point. The point is that they have done serious damage to our field, and for Harvard Medical School to give them top billing amounts to denial of the elephant in the living room. It’s collusion in service of their public rehabilitation. I told Dr. Salzman that his logic amounts to compartmentalized thinking. I might have added that Adolf Hitler gave a lot of great speeches that received rave reviews and that compartmentalized thinking was widespread in the nation of Germany between 1928 and 1945. Meanwhile, Harvard Medical School gets a black eye through its association with these compromised individuals. So do the other speakers who will be on the panel. Who needs this kind of taint? Dr. Salzman can defend Nemeroff and Schatzberg all he wants on specious legalistic grounds, but who cares? Harvard Medical School could use some moral clarity. So, we come back to the impeachment trial of Judge Porteous. Impeachment protects the institution. When sleazebags get into positions of authority and trust they need to be dumped, and our professional and academic institutions need to have enough spine to dump them. At the very least, we don’t need to tolerate institutions like Harvard Medical School pandering to compromised academic bad actors. For shame.

IMPEACHMENT: IT’S ABOUT THE INSTITUTION, NOT THE PERSON

IMPEACHMENT: IT’S ABOUT THE INSTITUTION, NOT THE PERSONThe impeachment trial of Judge G. Thomas Porteous of Louisiana this week was a lesson in civic ethics. The lessons of the Porteous trial apply to…

Đọc thêm »

08 Dec 2010

INSTITUTE of MEDICINE REPORT on CONFLICT of INTEREST

<div align="left"> INSTITUTE of MEDICINE REPORT on CONFLICT of INTEREST Today we saw a new marker laid down in the arena called Conflict of Interest (COI). The Institute of Medicine of the National Academy of Sciences issued a <a href="http://policymed.typepad.com/files/medical-coi-full-report-4-28-09.pdf">report</a> of its Committee on Conflict of Interest in Medical Research, Education and Practice. The report is comprehensive, even exhaustive, running to 353 pages. Gardner Harris in the New York Times <a href="http://www.nytimes.com/2009/04/29/health/policy/29drug.html?_r=1">today</a> calls it “scolding,” “stinging,” and “damning.” The recommendations go well beyond any proposed in the recent past by medical schools or by other professional organizations. The NYT quoted David Rothman, president of the Institute on Medicine as a Profession at Columbia University: “With the I.O.M.’s endorsement, issues that were once controversial now are indisputable. Conflicts of interest in medicine are no longer acceptable.” It will take some time for the field to digest the scope of the IOM recommendations. It will take even longer for the new standards to be implemented. For now, I offer just a few observations. First, if the IOM hopes for maximum credibility then it might ought want to do some housecleaning. A few years ago I fired a shot across the bow of the IOM concerning COI. [Can the Institute of Medicine Review the FDA? Nature Medicine 11, 369 (1 April 2005) doi:10.1038/nm0405-369] Nothing much changed, and in the following years, national scandals erupted involving several of the issues I had highlighted. Prominent IOM members, who were well known to be poster boys for COI, were exposed by Senator Charles Grassley (R-Iowa). Their embarrassing behaviors included incomplete financial disclosures and noncompliance with NIH policy on financial conflict of interest. The exposés included Emory’s Charles Nemeroff and Stanford’s Alan Schatzberg. In both cases, administrative rearrangements have now been implemented. The case of Dr. Nemeroff has been referred by Senator Grassley to the Inspector General of the Department of Health and Human Services. It is perhaps no accident that Dean Claudia Adkison of Emory and Dean Philip Pizzo of Stanford were included as external reviewers of the draft IOM report. Their insights would have been invaluable.</div> <div align="left"> Another ongoing embarrassment for the IOM is Lester Crawford. He was the FDA Commissioner who resigned abruptly in 2005 and later pleaded guilty to criminal conflict of interest. He had been charged with falsely reporting information about his stock holdings in companies he was in charge of regulating. He received a sentence of three years of supervised probation and a fine of about $90,000. He is now senior counsel with a health care lobbying firm in Washington, DC. The Institute of Medicine does not help its image by continuing the membership of such a compromised individual.</div> <div align="left"> As the Emory-Nemeroff and Stanford-Schatzberg cases unfolded it appeared that the respective institutions had themselves contributed to the problems, either through inaction or through studiously nontransparent procedures on disclosure. Stanford, for instance, apparently did not require faculty members to report the proceeds of stock sales, and when challenged the university invoked on-line financial reporting services and SEC filings as a sufficient substitute. Not surprisingly, because Stanford didn’t know about Dr. Schatzberg’s realized gain of some $109,000 from sale of founder’s stock in his biotech start-up company, Corcept Therapeutics, this information was not reported to NIH. Recommendation 4.1 One of the IOM’s recommendations applies particularly to the Stanford-Schatzberg case. Recommendation 4.1 addresses the boundary between academia and commerce in the case of research involving human subjects. Here is the specific language: “Academic medical centers and other research institutions should establish a policy that individuals generally may not conduct research with human participants if they have a significant financial interest in an existing or potential product or a company that could be affected by the outcome of the research. Exceptions to the policy should be made public and should be permitted only if the conflict of interest committee (a) determines that an individual’s participation is essential for the conduct of the research and (b) establishes an effective mechanism for managing the conflict and protecting the integrity of the research…” (page S-14). Last year I posted <a href="http://hcrenewal.blogspot.com/search?q=Schatzberg">several times</a> about this issue in the Stanford-Schatzberg case. It is gratifying now to see the IOM affirm the importance of the boundary. The activities declared off-limits by the IOM include not only “recruiting subjects; obtaining informed consent; assessing the clinical end points;” but also “analyzing data; or writing the results, conclusions, and abstracts for publications reporting the findings of the study.” (page 4-17). In Stanford’s earlier plan for managing the conflict and protecting the integrity of the research, Dr. Schatzberg was free to engage in the latter group of activities. Indeed, his hands were all over the project when it came to responding to scientific critiques, managing the climate of professional opinion, attacking and threatening critics, promoting his company’s interest through review articles and press releases, slipping unpublished and non-peer-reviewed commercial data into academic reviews, and generally conducting commercially slanted public relations through academic outlets. When Stanford adopts the IOM recommendations, such activities will be blocked. As I <a href="http://hcrenewal.blogspot.com/2008/07/managing-conflicts-of-interest-at.html#links">stated</a> last year, “Review articles that assess a field and synthesize data form a crucial part of science that has to be off-limits to Dr. Schatzberg just as much as assessing patients in one of his clinical trials would be.”</div> <div align="left"> We should congratulate the IOM committee members for their work, and we hope to see the field embrace their recommendations. Bernard Carroll. </div><div align="left"></div><div align="left">UPDATE 04-30-2009: The link provided earlier for the IOM report document is no longer operative. Here is where to go now for a copy of the report. This time it will cost you.</div><div align="left"><a href="http://www.nap.edu/catalog.php?record_id=12598">http://www.nap.edu/catalog.php?record_id=12598</a> </div>

INSTITUTE of MEDICINE REPORT on CONFLICT of INTEREST

INSTITUTE of MEDICINE REPORT on CONFLICT of INTERESTToday we saw a new marker laid down in the arena called Conflict of Interest (COI). The Institute of Medicine of the National Academy of Sciences is…

Đọc thêm »

28 Apr 2009

Load more posts