KOMpliance eases medical image storage compliance rules
Published – September 21, 2010 | SearchHealthIT.com
Don Fluckinger, Features Writer
Clinical picture archiving and communication systems (PACS) pose a number of problems for users: They are storage hogs; they aren't necessarily interoperable; and their owners are subject to state and federal medical image storage rules, as well as Health Insurance Portability and Accountability Act (HIPAA) privacy laws. This scenario is true for hospitals, as well as for freestanding facilities that generate lots of patient scans -- an ambulatory radiology clinic, for example.
That was the situation at Angel Medical Center, a nonprofit critical access hospital in Franklin, N.C. New, three-dimensional imaging gear and a digital mammography upgrade drove its radiology department to pump out more megabytes than ever. The hospital's combined storage area network, or SAN, and back-end network-attached storage archiving system needed both organization and consolidation.
Furthermore, to streamline compliance with North Carolina's record-retention laws -- which require that adult patients' images be archived for 11 years, and children's images until they're 21 years old -- the hospital wanted to automate image retention, encryption and protection for the required period and to implement secure erasure policies for every image in the archive once that period was over.
Medical image storage and HIPAA compliance
To satisfy HIPAA's privacy tenet of limiting access to patient data to the minimum necessary number of caregivers, Angel Medical had to track who was accessing images. In addition, the Food and Drug Administration's Mammography Quality Standards Act and Program requires that mammography scans be retained for 10 years or until the next scan is done.
Much needed to be done. "We had an old server storing archived images from the PACS system. It was reaching its capacity and becoming increasingly slow and problematic, with the increasing number and sizes of image studies," said Lori Smith, Angel Medical's radiology director. "We needed to quickly increase performance and capacity."
The hospital accomplished that by adding four KOMpliance storage appliances from Ottawa-based KOM Networks Inc. The boxes apply policies to images that fit the complex stream of rules governing patient data. One appliance upgraded medical image storage from the facility's obsolete optical jukebox and stores its Meditech electronic health record (EHR) system. Another stores PACS images. Two more back up the primary archive off-site for disaster recovery.
The setup lets Angel Medical minimize the medical images' storage footprint; maximize EHR and imaging access to multiple practitioners in separate locations; and manage privileges by assigning, validating and documenting user logins. Opening up access to archived images is crucial. It reduces the cost of care for patients, as well as the possibility of denied reimbursements when insurers won't pay claims for procedures they deem redundant.
Consolidating medical image storage, centralizing management
"[The system] eliminates the need for repeat studies when patients present at different locations. By eliminating duplicate studies, we reduce the amount of storage needed for those images, as well as the significant cost of the studies themselves," Smith said. "By consolidating the storage environment and centralizing the management of archived images, we are able to access, store and protect archived images on the most cost-effective storage devices, as well as provide redundant storage to meet HIPAA requirement[s]." In addition, the system reduces patients' exposure to radiation and enhances their safety, because a practitioner can come to a decision about treatment from looking at an archived image, instead of having to order yet another scan.
The key to migrating hospital data successfully from an old to a new medical image storage and archiving system is to maintain access to the data with minimal disruption to health care operations, said Kamel Shaath, chief technology officer at KOM Networks. That, plus making sure the new archiving system looks familiar and intuitive to end users, and does not require a lot of training to access patient data.
"You need the infrastructure to be dynamic and evolve," Shaath said. "Access has to always remain consistent, but infrastructure must evolve. There are so many efficiencies you can achieve over time."
For radiology departments, having viewers attached to the system that enable -- and log -- access is another key, Smith said. This enables practitioners to get their work done in a HIPAA-compliant way, whether they are viewing images from a CD-ROM, a DVD or the Internet, or directly on the network.