Artificial intelligence is already used widely in healthcare, but generative AI is a big — and somewhat risky — step forward due to rapid deployment of the technology paired with a lack of regulation and oversight, industry experts said at the HIMSS conference in Chicago this week.

As a result, tough ethical questions are dogging generative AI like GPT-4, OpenAI’s latest large language model that backs the premium version of the wildly popular chatbot ChatGPT. Still, generative AI has huge potential to help improve U.S. medical care, proponents say.

One of the biggest companies in the space, Microsoft, has been working with GPT-4 developer OpenAI over the last eight months to understand the technology’s implications for healthcare. Generative AI is showing early success in a number of use cases, including simplifying explanation of benefits notices and writing prior authorization request forms, Peter Lee, corporate vice president of Microsoft Healthcare, said in a keynote panel on Tuesday.

Physicians can give the AI prompts to help them interpret novel medical cases or rewrite a patient conversation in a standardized format, Lee said.

Microsoft recently unveiled plans to embed generative AI into clinical software from Epic, the biggest hospital EHR vendor in the U.S.

Last week, Microsoft and Epic went live with the first sites integrating GPT into EHR workflows to automatically draft replies to patient messages. The companies also are bringing generative AI tools to Epic’s hospital database, allowing laypeople to ask the AI general questions instead of needing a data scientist to query specific data.

Epic is investing a significant amount of R&D resources into generative AI, Seth Howard, Epic’s vice president of R&D, said in an interview.

The health IT company also is researching the use of generative AI to summarize a patient’s medical history, and translate patient-facing materials between different languages and reading levels, to improve health literacy.

“That’s kind of a big category of work,” Howard said. “There are many use cases we’ll put out over the next year.”

Google also is making its own large language model, called Med-PaLM 2, available to a select group of customers to explore use cases. Med-PaLM was specifically trained on medical data, allowing it to sift through and make sense of massive amounts of healthcare information. Still, it has room for improvement in the complexity of queries it can perform and meeting product excellence, according to Google’s AI team.

Med-PaLM won’t be used in patient-facing settings, Google Cloud head Aashima Gupta said in an interview. Instead, hospitals could use the AI to analyze data to help diagnose complex diseases, fill out records or as a concierge for patient portals.

One notable use case for generative AI is streamlining medical notetaking, experts say. Physicians can spend up to six hours a day logging notes in their EHR, which can result in cutting back on time with patients and contribute to burnout.

Leading clinical documentation companies are integrating generative AI technology that they say improve their products’ accuracy and speed.

Nuance, a documentation company owned by Microsoft, said last month that it had integrated GPT-4 into its clinical notetaking software. This summer, providers using existing Nuance documentation products can apply to beta test the application, called DAX Express.

Ten to 15 clients summing 300 to 500 physicians will test the product in private preview in mid-June, before it’s generally available in early fall, said Diana Nole, general manager at Nuance.

Suki, a documentation company that’s partnered with Google, launched its generative AI-powered “Gen 2” voice assistant earlier this month.

Now, Suki can generate a clinical note ambiently from a conversation and fill in the note automatically, CEO Punit Soni told Healthcare Dive. Closer to the end of the year, doctors will also be able ask the AI questions and give it commands, such as plotting a patient’s A1C levels over the last three months, Soni said.

Gen 2 currently is being piloted with “very few” customers, according to the CEO. Suki plans to make it generally available later this year.

”The interest is unbelievable,” Soni said. “If you could have somebody to just do all your notes for you — wouldn’t that be awesome?”

Weighty risks

To be sure, generative AI makes mistakes, raising pernicious ethical questions around accuracy, equity and accountability. That means the medical community needs to have a robust ongoing role in deciding whether, when and how this type of AI is used, experts said at HIMSS.

One issue with AI is the black box problem: How can a result be trusted if it’s unclear how the AI got there?

It’s easy to be fooled into thinking that this type of technology is able to reason, but users have to remember generative AI doesn’t engage in deliberation — just predicts the next set of words that makes the most sense, said medical ethicist Reid Blackman.

“Maybe we’re okay with magic that works. That’s one option. The other option is to say okay, if you’re making a cancer diagnosis, I need to absolutely understand the reasons why you’re making that diagnosis… The problem is that GPT doesn’t give reasons. It gives what looks like reasons,” Blackman said on a Tuesday panel.

Generative AI also has issues with accuracy. Large language models are known to hallucinate, or provide answers that are factually incorrect or irrelevant. GPT-4 “still has many known limitations that we are working to address, such as social biases, hallucinations, and adversarial prompts,” OpenAI’s website reads.

Bias is another key worry with AI, especially in healthcare. If an algorithm is trained on biased data, or its results are applied in biased ways, it will reflect and perpetuate those biases, experts said.

Accountability also remains a concern. Since generative AI is such a new field, it’s unclear which stakeholder — the owner? the user? the developer? — is at fault for any negative consequences stemming from its use, according to Kay Firth-Butterfield, CEO of the Centre for Trustworthy Technology.

“Who do you sue when something goes wrong? Is there somebody to sue?” Firth-Butterfield asked during the Tuesday keynote panel.

More than 27,000 stakeholders have signed an open letter asking AI labs to immediately pause training AI systems more powerful than GPT-4 for at least six months. The letter argues that industry should use the moratorium to develop shared safety protocols and work with policymakers to develop AI governance systems.

“You shouldn’t be exploring, engaging in artificial intelligence, without having some understanding of responsible AI issues,” said Firth-Butterfield, who signed the letter. “We are hurtling into the future without actually taking a step back and designing it for ourselves.”

‘Mysterious,’ ‘awe-inspiring,’ ‘frustrating’

AI companies argue many of these problems can be ameliorated with careful human oversight. Organizations should be explicitly aware of the dataset a model was trained on and when precisely it should be used, experts said.

Microsoft’s Lee said while questions about generative AI are important, especially those around accountability, the black box problem might not be as troubling as some say.

“We’ve been unable to provide its incapable [of reason],” Lee said. ”It’s a mysterious and awe-inspiring and frustrating research roadblock that we’ve been unable to prove that. I have to admit, as a scientist, that this black box issue, at some point of development starting with GPT-4, actually might not really exist.”

And there are techniques to ensure generative AI gives a reliable output — a field called prompt engineering, where scientists figure out how to query the AI in a way that produces trustworthy results, Epic’s Howard said.

Both Suki and Nuance declined to share the accuracy rates of their generative AI-based notetakers, but said accuracy was high enough that they’re comfortable instituting them in a real-world setting.

Soni said Suki could publish its Gen 2 accuracy rates in a few months. And Nuance has been working with AI for years, Nole said.

“The level of accuracy we were already producing is advanced. We know how it works. We know how it acts. Now, we’re just utilizing GPT to kind of raise the level,” Nole said.

As AI has advanced, some models have outperformed doctors on diagnostic tasks, creating concerns that machines could one day replace clinicians. Experts at HIMSS agreed that day is nowhere close, even with generative AI.

Med-PaLM’s ability to pass a medical exam is “in no way indicative of medical knowledge or competence,” Alan Karthikesalingam, Google’s health AI research lead, said in an interview.

“There are a lot of material safety, bias and ethical concerns that need to be attended to very carefully,”  Karthikesalingam said. But replacement? “I think by and large that on its own is hopefully not a huge concern to us physicians. The positioning of these systems is very much as tools.”

Suki and Nuance stressed that their AI-created notes allow clinicians to edit and approve what is finalized in the EHR. Generative AI is an instrument for doctors, not a substitute for them, AI executives said.

Still, “anyone who can make predictions on what this epoch will bring is a fool,” Soni said. “What I can tell you is that in the foreseeable future, I see AI being a very strong and serious assistant that makes a lot of our lives better.”

Artificial intelligence could have significant benefits for healthcare, but Congress needs to keep an eye on potential risks as the rapidly evolving technology becomes more prevalent in the sector, lawmakers noted in a House subcommittee hearing on Wednesday.

Legislators questioned witnesses during an Energy and Commerce health subcommittee hearing on a wide range of benefits and dangers that could arise — including risks to patient privacy due to the amount of data needed to train AI models and whether current privacy legislation is up to the task.

“[We have] a lot of very engaged members who want to understand it, and are working to understand it, so we can act appropriately to protect, but without impinging the great things that could come from this,” said Rep. Brett Guthrie, R-Ky. 

Data privacy — already a challenge for healthcare amid an increase in data breaches and cyberattacks — is one concern for lawmakers. Strong federal data privacy protections for consumers is key to AI regulation, said Rep. Frank Pallone, D-N.J.

“AI cannot function without large quantities of data. And we must ensure that this increased data demand does not come at the expense of consumers' right to privacy,” he said.

High-quality, diverse and large datasets are necessary to train and improve AI models, said Michael Schlosser, senior vice president of care transformation and innovation at for-profit hospital chain HCA Healthcare. Providers have been operating with the Health Insurance Portability and Accountability Act for decades, and it’s provided a solid roadmap to manage privacy concerns, he added.

However, not all entities collecting health data are covered under the HIPAA privacy law. Consumer apps collect health information that is frequently provided by patients, and they could generate algorithms without transparency into how the data will be used, said Christopher Longhurst, chief medical officer and chief digital officer at UC San Diego Health.

The Federal Trade Commission has already taken some steps to crack down on digital health companies for sharing data. Earlier this year, regulators fined drug cost platform GoodRx, Teladoc-owned virtual mental healthcare provider BetterHelp and fertility app Premom for allegedly sharing consumers’ health data for advertising purposes. 

But, in a growing ecosystem of apps and wearable devices, lawmakers need to consider legislation that would set the groundwork for how data is collected, used and shared, said Rep. Greg Pence, R-Ind.

“We should do that before we can look at regulating AI in healthcare and find the balance in simultaneously encouraging private innovation,” he said. “Our increasingly digital world leaves Hoosiers and all Americans in the dark about who has access to their information.”

Access to quality data to train healthcare AI can also be a challenge, said David Newman-Toker, director of the division of neuro-visual and vestibular disorders at the Johns Hopkins University School of Medicine. 

The most reliable datasets exist for radiology and laboratory medicine, but data contained in electronic health records is often missing or inaccurate, he said. AI trained on that data could replicate human biases or provide incorrect answers altogether, so research funding for “gold-standard” datasets should be a priority. 

“We have to start coordinating data architectures, and we have to start developing and curating good datasets that can be used at a large scale to train these AI models,” Newman-Toker said. “And so I do think that that's going to take a big effort, and one that would be best coordinated federally.”

Sponsored content

By Locumsmart

Health systems face numerous challenges in the pursuit of delivering high-quality patient care while maintaining operational efficiency. To address these challenges, many healthcare organizations are leveraging more data for deeper insights into operations, particularly when it comes to business intelligence for locums staffing. Good business intelligence allows healthcare administrators to make more evidence-based strategic staffing decisions. This is particularly important when it comes to making decisions about locum tenens, which can be costly when not billed for and managed correctly. On the other hand, the strategic usage of locums providers will not only relieve pressure on staff but drive revenue for the organization. 

Data-driven locum tenens strategy 

For healthcare organizations that utilize locum tenens providers as part of their staffing strategy, business intelligence can be especially critical for operational efficiency and human resource management. “The most important part of business intelligence for locums staffing is visibility,” says Sara Viola, manager of key accounts at Locumsmart. “A lot of facilities don’t know what their locum spend is and they don’t know what they’re capturing in terms of payor enrollment.” “If you just look at an invoice from a locum, you can easily come to the ‘conclusion’ that locums is a cost,” she continues. “But by utilizing analytics and having visibility into your locums activity and utilization, you’re able to draw some lines to understand locums as a revenue-generating stream versus a cost center.” 

Locums specialty utilization 

Tracking the utilization rates of physician specialties within the facility helps health systems allocate staff resources efficiently. By analyzing specialty-specific patient demand, facilities can ensure adequate staffing levels, prevent overburdened departments, minimize patient wait times, and efficiently engage locums providers. “As a healthcare organization utilizing locums, understanding your specialty utilization is critical. Are you supporting your highest-generating service lines with coverage? And, conversely, are you perhaps spending money on service lines that are not revenue generating?” says Resa Konkright, director of healthcare organization management at Locumsmart. “In many organizations, it can be challenging to see,” Konkright continues. “Business intelligence gives total visibility into what’s happening operationally and may support scheduling decisions to help organizations generate revenue most efficiently.” 

Locum tenens vendor performance 

Health systems rely on numerous vendors to meet their staffing needs. Monitoring and evaluating vendor performance metrics can help healthcare organizations ensure the availability of essential staffing resources without disruption. “By evaluating vendor performance, you can see your speed to bid, your days to fill a job, and which vendors are performing well,” says Konkright. “This data also serves as a rate comparison to understand each vendor’s offering better.” 

Healthcare market trends 

To stay competitive, health systems should stay abreast of evolving market trends to adapt their services and staffing strategies accordingly. Analyzing data on patient demographics, treatment preferences, and regional healthcare demands enables facilities to anticipate changes and align their staffing patterns with emerging needs. “Analyzing market trends is key to projecting demand and forecasting spend,” says Konkright. “By evaluating data such as spend per state or top specialties nationally, you can better understand and prepare for specialties where locum tenens rates are increasing due to demand.” 

Business intelligence can power better decisions 

Health systems can’t manage what they can’t see. Locum tenens data that’s tied up in multiple spreadsheets or siloed in different departments can limit an organization’s ability to see the whole picture and make informed decisions. “It can be challenging to even know the right questions to ask of your data,” says Matthew Patterson, CTO of Locumsmart. “At Locumsmart, we see the entire market, not just one area. We see the challenges multiple organizations are facing and hear the questions multiple people are asking. We see the macro view and can help organizations understand their piece of it.” One of the advantages of working with Locumsmart is that it can provide visibility into your entire locum tenens usage and spending. Whether you work with just a few vendors or a dozen to fill your needs, Locumsmart’s business intelligence tools can give you visibility across all your vendors. The integration of business intelligence and data analytics has become a necessity for health systems. Regarding staffing, optimizing the clinical workforce can contribute to cost containment and financial sustainability, ensuring health systems can continue to provide quality care in the long term. 

Hacking healthcare:

With 385M patient records exposed, cybersecurity experts sound alarm on breach surge

Cybersecurity experts say healthcare companies must harden their defenses, but it may require regulators and lawmakers to raise the bar on security standards.

Published March 9, 2023 • By Samantha Liss and Jasmine Ye Han

Healthcare companies more than ever are using electronic records and tapping digital services. That’s also creating more opportunities for cybercriminals — who already have exposed the private medical information of millions of patients — and bolsters the case for the industry to make security priority No. 1, experts say.

Healthcare breaches have exposed 385 million patient records from 2010 to 2022, federal records show, though individual patient records could be counted multiple times.

Hacking incidents, a type of breach, at healthcare firms have skyrocketed in the past five years as cybercriminals demand ransoms in exchange for restoring access to sensitive medical data.

Hacking or IT incident is the most common breach type

Other types include unauthorized access/disclosure, theft, loss, improper disclosure, other and unknown.

While healthcare companies have to improve their cybersecurity given the rise in breaches and cyberattacks, regulators need to raise the bar on cybersecurity standards, experts told Healthcare Dive.

"Could all these organizations do a better job? Absolutely," said Jim Trainor, former assistant director of the Cyber Division at the Federal Bureau of Investigation and who is now a senior vice president of Aon Cyber Solutions, a global professional services firm.

Disrupting any one of the nation's 16 critical infrastructure sectors, including the healthcare industry, poses a national security threat. These sectors are vital to daily life for millions of Americans and disabling them would have a debilitating effect on society, according to the Cybersecurity and Infrastructure Security Agency, or CISA, the country's cyber defense agency.

Cyberattacks that disrupt hospital operations put patients' lives at risk. The FBI said that the healthcare industry was hit the hardest by ransomware attacks in 2021 compared to other critical infrastructure. And the threats come as hospitals struggle with staffing shortages and financial pressures exacerbated by the COVID-19 pandemic.

In the wake of a ransomware attack on one of the nation's largest hospital operators last year, Healthcare Dive analyzed more than 5,000 breaches reported over the past 13 years to the HHS Office for Civil Rights, the agency tasked with enforcing privacy and security laws in the healthcare sector.

A breach is a broad term for when protected health information that can identify patients is improperly revealed or used. A hacking or IT incident is a type of breach that involves a technical intrusion, according to the HHS, and is just one type of breach tracked by the agency.

0

The number of breaches has increased almost every year since reporting first began in 2009. Healthcare Dive confined its analysis to breaches that affected more than 500 people in each incident.

The number of breaches reported each year more than tripled from nearly 200 in 2010, the first full year that data was available, to more than 700 in 2022.

More than 52 million people* had their private health information exposed in 2022 in more than 700 breaches, up from about 6 million people in 2010.
*One person could be counted multiple times if exposed in multiple breaches.

The upward trend is more apparent if the 2015 Anthem breach is excluded.

The size of each breach — or the median number of people affected in each incident — has also jumped since 2018. The median is the midpoint between the largest and smallest breach and is less distorted by outliers.

Last year, the median breach affected more than 6,200 people, more than twice the size of the median breach in 2018.

Breaches can dramatically range in size in terms of the number of people affected in each incident.

The vast majority of reported breaches affect fewer than 65,000 people.

The second-largest breach disclosed since reporting first began in late 2009 affected 11.5 million individuals.

The largest reported breach occurred in 2015 and exposed the private health information of almost 79 million people through a cyberattack against Anthem, one of the nation's largest insurers. An investigation by regulators found that Anthem, now known as Elevance, did not have adequate protections in place to ward off cyberattacks. Anthem later agreed to pay a $16 million settlement with HHS OCR.

Cyberattackers infiltrated Anthem's IT systems through spear phishing emails sent to an Anthem subsidiary. Attackers stole patient information including full names, social security numbers, addresses, birth dates, emails and employment information, according to HHS OCR.

Health insurers, providers, clearinghouses and business associates are required to notify the HHS OCR when breaches occur. If a breach affects the private health information of more than 500 people, covered entities have 60 days to notify regulators.

The rise in breaches comes as healthcare companies have increasingly adopted digital services over the past decade, leaning more heavily on health information technology.

The use of electronic health records by hospitals, especially, has soared since 2010, when providers began to take advantage of federal incentive programs that made billions of dollars available to those that opted to use EHRs.

EHR adoption rate jumped to almost 100% within four years

Still, that connectivity can lead to cyber vulnerabilities and create avenues to access protected data, they said.

During just one episode of care, multiple entities may access a patient's information, including doctors, hospitals, X-ray facilities and insurance companies, Aon Cyber Solutions’ Trainor said.

"The complexity of the network to facilitate the events is unbelievable," Trainor said.

A rush to remote work fueled more entry points for attackers

The hospital sector became even more vulnerable during the pandemic, which dramatically accelerated the use of network- and internet-connected devices, said John Riggi, who advises the American Hospital Association on cybersecurity and risk. As non-clinical employees pivoted to working from home, hospitals increased their reliance on third-party and cloud services.

It led to an "expanded digital attack surface," said Riggi, who previously served as an FBI section chief overseeing cyber issues.

Hospitals' dependency on third-party technology also makes them more vulnerable because they don't have total control over the security of third-party tools, Riggi added. As a result, hospitals have to wait for vendors to send patches for connected medical devices and are prohibited from patching problems themselves.

“

The chain is only as strong as its weakest link and there are so many weak links.

Israel Barak, chief information security officer at Cybereason

”

"The key is we are being attacked by foreign adversaries. The vast majority of compromised records are from hostile acts, meaning foreign-based adversaries that even the FBI can't put their hands on," Riggi said.

"It becomes very, very difficult to secure this expanded attack surface under increased fire during a pandemic," Riggi added.

Israel Barak, chief information security officer at Cybereason, a cybersecurity firm based in Boston, added that many healthcare companies lack robust cybersecurity programs.

"The chain is only as strong as its weakest link and there are so many weak links," Barak said.

This makes healthcare an easy and profitable target for cyberattackers, he added.

Get healthcare news like this in your inbox daily. Subscribe to Healthcare Dive.

Sign up

When breaches do occur, "the blast radius is bigger because of the information sharing," said Christina Powers, partner at West Monroe who leads the firm's Cybersecurity Advisory for Private Equity Program.

That may explain why the average breach size has surged in recent years, Powers added.

To be sure, not all breaches are the result of cyberattackers.

The federal government tracks a handful of breach types: hacking/IT incident, which can include cyberattacks; improper disposal; loss; theft; and unauthorized access/disclosure.

The second-most common type of breach in recent years is the result of unauthorized access or disclosure, which can occur when an employee accesses records outside of their job duties, according to Healthcare Dive's analysis. It can also include when patient information is exposed through misdirected communications.

Other types include loss or theft, such as when laptops or thumb drives are left in public places or stolen.

Rich data, profitable targets

Ransomware attacks are a top threat facing the industry because healthcare organizations are profitable targets, according to security experts.

In a ransomware attack, hackers lock out healthcare institutions from critical files and information and hold it hostage while demanding a payment in exchange for a decryption key to unlock the files.

Cybercriminals know healthcare organizations will feel pressure to rapidly restore access to lifesaving systems and technology.

Providers are more likely to pay a ransom when the disruption threatens patient care, such as when emergency rooms are shut down or when facilities are forced to reroute patients, Aon Cyber Solutions’ Trainor said.

The FBI has warned that these attacks can put patients at risk by delaying access to care and vital information.

A newborn died allegedly as result of a ransomware attack that disabled computers on every floor of an Alabama hospital and strained resources, according to The Wall Street Journal. The report said that Teiranni Kidd's daughter died months after she was delivered with the umbilical cord around her neck.

A 2021 survey of nearly 600 IT and health executives at provider organizations showed that ransomware attacks had a significant impact on patient care. Of those that experienced a ransomware attack, the majority reported longer lengths of stay; delays in procedures and tests; and diversions. More than one-third of respondents cited increased complications and almost one-quarter flagged increased mortality rates.

For ransomware criminals, 'it's all about ROI'

Ransomware attacks on healthcare organizations have increased in frequency and severity since 2016, researchers found and tracked through the database, THREAT, or Tracking Healthcare Ransomware Events and Traits.

"It's all about ROI" for these criminals, Trainor said.

In addition, it can be difficult to deter bad actors, who can launch attacks from other countries and are often outside the reach of U.S. law enforcement, according to security experts.

In September, three Iranians were charged with attempting to launch a cyberattack on Boston Children's Hospital, one of the largest pediatric medical centers in the country.

FBI Director Christopher Wray later characterized the foiled incident as "one of the most despicable cyberattacks I've ever seen."

While the FBI was able to intervene before the attack was committed, the incident raised concerns about nation-state attacks on healthcare operators in the U.S.

"I do think we need to be prepared about the possibility of disruptive or destructive attacks by nation-states on healthcare, too," said Morgan Demboski, a threat intelligence analyst for IronNet, a cybersecurity firm based in McLean, Virginia.

Attacks can be motivated by cyberespionage as well, Demboski added.

Some nation-states aimed to steal vaccine-related information and other medical research linked to the coronavirus to boost their own commercial sector, Demboski said.

Amid this threat landscape, healthcare firms should upgrade their cyber preparedness and may need a push from federal regulators, security experts said.

“

... the level of security across the industry is not where it needs to be to protect patients' healthcare information.

Jim Trainor, senior vice president of Aon Cyber Solutions

”

On March 1, President Joe Biden unveiled a sweeping national cybersecurity strategy that seeks to improve the nation's cyber defenses. The policy goal calls for establishing minimum cybersecurity standards across critical infrastructure, including the healthcare industry.

The policy plan, while not an executive order, will serve as a guide for federal agencies and lawmakers to enact cyber requirements.

Raising the bar on cybersecurity standards is critically important for healthcare companies, security experts said.

"I think we need to set a higher regulatory standard for healthcare organizations," Cybereason's Barak said.

To be sure, raising the bar will likely come with financial consequences for hospitals and may raise healthcare prices, Trainor said.

Still, Trainor added, "the level of security across the industry is not where it needs to be to protect patients' healthcare information."

Methodology

Healthcare Dive downloaded the health breaches dataset from the HHS (Archive -> Research Report) on March 2, 2023. The data serves as a living document, which the OCR may update after each investigation. Covered entities have 60 days to report breaches that affect more than 500 people to the OCR. Breaches involving fewer than 500 people may be reported on an annual basis and are not included in the downloadable data.

Dates of breaches mentioned in the charts refer to the date when a breach report was submitted.

News graphics developer Julia Himmel and visuals editor Shaun Lucas also contributed to this piece.

Related content

After CommonSpirit ransomware attack: Why healthcare M&A is a ‘huge’ cybersecurity risk.

By Samantha Liss • Oct. 27, 2022

CommonSpirit Health confirms it was hit by ransomware attack

By Samantha Liss • Oct. 13, 2022

CommonSpirit’s ‘IT security incident’ was likely cyberattack, security experts say

By Samantha Liss • Oct. 7, 2022

Credits

Samantha Liss

Senior Reporter

Jasmine Ye Han

News Graphics Developer

Julie Yoo is a staunch advocate for companies at the intersection of healthcare and finance. And as a general partner and leader of health tech investment at Andreessen Horowitz, she’s well-situated to fuel companies looking to ameliorate payment problems in healthcare.

Yoo joined Andreessen Horowitz, otherwise known as a16z, in 2019 after co-founding patient access startup Kyruus — an experience that Yoo says gave her a front seat to the financial challenges faced by both healthcare companies and patients.

Andreessen Horowitz — the biggest venture capital firm by assets under management —  has been an active digital health investor after the pandemic spurred record fundraising in the sector, according to Pitchbook data. The VC recently inked a broad thesis outlining where it sees attractive investment opportunities in the healthcare fintech landscape.

Yoo shared that investment thesis in a wide-ranging interview with Healthcare Dive that also touched on her advice for founders going up against entrenched behemoths and why the industry is at a tipping point for fintech adoption.

HEALTHCARE DIVE: Why is fintech in healthcare such an area of interest for you?

JULIE YOO: While at Kyruus, I got fascinated about the financial flow of payments, which drives all the things that work and, more importantly and more frequently, the things that don’t work in our system.

In addition, if you think of insurance as fintech, those are clearly the biggest companies in the space. We’ve done a lot of work to understand and unbundle those business models. What are the components of giants like UnitedHealth Group? How do they tick? Where are opportunities for startups to compete head-to-head to provide a 10 times better experience or 10 times better competency? And where are the white spaces where UnitedHealth doesn’t have a good footprint that startups can go after? We’ve made a number of investments based on that thesis.

What are the biggest opportunities you’ve identified for fintech startups in healthcare?

YOO: The simplest is administrative bloat. The majority of waste in our industry is administrative overhead of unnecessary or redundant tasks that are done through inefficient human labor that can absolutely be automated. We have a number of companies in our portfolio that represent that thesis, of how do you use cutting-edge technologies to do some of the simplest tasks across the revenue cycle.

We have companies doing that on the reimbursed revenue side, like Akasa, and companies doing that on the patient side, like Cedar. I show these products to my colleagues in our consumer and enterprise practices and they’re kind of like, what’s special about that? And I’m like, it’s special in healthcare.

The second bucket is the actual payment model, and how we can create technology solutions that actually contemplate value-based payment models versus fee-for-service. We have a company in our portfolio called Pearl Health that provides software to provider groups to help them bear risk, creating a recurring revenue model that’s far more resilient for these practices. We’re getting a lot of interest from providers who want to stay independent.

How do you advise your startups that are going head-to-head with larger companies to carve out market share?

YOO: A lot of investors are averse to starting with a wedge. Some people look at the segment of the universe that’s attainable to Pearl today and say oh, that’s too small, it’s not worth our while.

Pearl is going to that underserved long tail of practices that no one else cares about, including other risk-assumption companies like Optum or Agilon or Aledade — because they’re big and have growth targets, there’s just a certain floor of what they can go after. But we believe every niche in healthcare can be $10 billion over time.

We are taking a bet that value-based, risk-bearing primary care is the future and the industry is going to continue to move in that direction. But if it does, then the seemingly small segment that Pearl is able to go after today will be 100 times what it was.

Where else do you see opportunity besides value-based care?

YOO: It’s all about finding the severely underserved pockets of the market. On the employer benefits side, direct purchasing from employers is to me a signal of where they aren’t being served by their health plan. All of the point solutions in these areas — employers aren’t getting what they need from their payers.

From a fintech lens, we’ve invested in a couple of companies here, like Thatch. They’ve created a single card — you can swipe your medical expenses on that card, and they’ve built a software layer that allows for real-time adjudication of whether that expense is a covered benefit. And they have a marketplace of health plan products you can buy too.

Turquoise is another company that’s operating in the payer-provider interface. They’re digitizing payer-provider contracts, and becoming a system of record for that. They can forecast out — using price transparency data — how much a provider’s revenue would change if you were to negotiate this one term in a contract. That allows you to scenario plan.

We’ve been very surprised by the upside on how many people are buying Turquoise’s data. Payers and providers are using it for competitive intelligence, because now they can see everyone in their markets and what they’ve contracted for. They also can use it to get their own house in order. We’ve also had some hedge funds reach out to us who wanted visibility into the publicly traded providers and payers to inform their market research.

Are we at an inflection point for fintech adoption?

YOO: I do think we’re at a tipping point. With value-based care, we’ve demonstrated scale, specifically in the primary care and Medicare Advantage world. The CVS-Oak Street acquisition was a nice crucible moment where people recognized now the big players are paying attention — this is a viable strategy.

We believe that will be replicated in different forms across the commercial market. We have an investment called Firefly Health that’s a payvider focused entirely on value-based models for employer markets. We have a company called Waymark that’s doing this in Medicaid.

On the employer side, companies will go bankrupt if they don’t figure out their healthcare benefits financing strategy.

And on the administrative layer piece, hospitals are finally waking up and realizing they need to transform their operating model to survive. They’re losing staff left and right. That’s where we’re seeing a lot of movement on automation.

Are there roadblocks?

YOO: So many. Any time you’re selling to enterprises, there’s just general inertia, and conservatism of doing new things. It’s the paradox of, you’re bleeding money, and this solution can make you more money, but you have to make the investment to get the new solution in place.

Then there’s the, we’re going to build it ourselves. So large companies like United — their bias is we’re going to do this ourselves. Why would we waste our time working with startups? But that can be a benefit. Their competitors, the underdogs, want any kind of competitive edge they can get.

Digital health funding is waning. How would you characterize the current state of the market?

YOO: I keep telling my founders, even in this downturn it is 10 times better today than it was in 2010. This is a very normal, healthy environment, frankly, where people care about your economics and efficiency. That’s how it was before the pandemic.

We’re just so early. We’re in the 1999 of the internet era in digital health. We truly have not even gotten started with respect to these tech-oriented models. These companies just haven’t grown up yet. It’s still going to be another five to 10 years before we see the real scale of potential outcomes in this domain.

For that to occur we need more funding in growth stages. I think there’s a tremendous investment opportunity coming in the next couple of years.

Dive Brief:

• Cigna’s health services division Evernorth has acquired the technology and clinical capabilities of asynchronous telehealth provider Bright.md for an undisclosed amount, the company announced on Tuesday at the HLTH conference in Las Vegas.
• Evernorth’s telehealth business MDLive plans to start offering asynchronous care using the new capabilities within its virtual urgent care platform in 2024, and eventually expand asynchronous care to chronic disease management and wellness visits.
• A spokesperson for the company said it was too early to share a specific timeline for the launch in virtual urgent care and the expansion to more clinical areas. Currently, more than 43 million people have access to MDLive virtual urgent care through their health plans and employers, Cigna says.

Dive Insight:

Asynchronous virtual care allows clinicians to review information, render a diagnosis and prescribe needed medication without communicating in real time with a patient.

A crop of startups, including Bright.md, Zipnosis and 98point6 — as well as nontraditional entrants like Amazon, with its telemedicine marketplace — are peddling asynchronous care tools that allow patients to triage low-acuity healthcare needs without having to rely on costlier avenues of care like an emergency department visit, or wait for a primary care appointment. 

When asynchronous care launches next year, MDLive users will be guided through a digital clinical interview that will be converted into a chart note. A clinician will review the note and provide a diagnosis or prescription, or direct the patient to a different care setting if needed, according to Cigna.

At a time when insurers are facing growing public scrutiny over their use of algorithms to review claims, Cigna’s release on the new offering says the asynchronous care experience “is not based on artifical intelligence or machine learning.”

An Evernorth spokesperson said Bright.md’s platform uses branching logic to identify and ask follow-up questions, and all decisionmaking is done by the treating clinician.

However, Bright.md in past releases has said its software uses AI to inform new questions based on information provided by the patient.

Portland, Oregon-based Bright.md was founded in 2014 as a virtual care platform for direct-to-patient telehealth. The startup, which has raised roughly $31 million to date, sells its software to health systems, including West Coast system Adventist Health, Prisma Health in South Carolina and Rush University Medical Group in Chicago.

In those deals, a clinician (normally an urgent care provider) employed by the system is used to staff asynchronous care. At Cigna, patients who take an asynchronous visit will be treated by MDLive clinicians, according to the Evernorth spokesperson.

Cigna will license Bright.md’s technology back to the company in a continuing services agreement so its health system clients can continue using the platform, the spokesperson said.

Cigna purchased MDLive in 2021 as demand for virtual care snowballed during the COVID-19 pandemic. The Connecticut-based payer has expanded the telehealth provider’s capabilities as employers expressed more interest in virtual-first health plans, adding chronic condition management last year.

Dive Brief:

• Cleveland Clinic and multinational imaging company Canon are partnering to research and develop new imaging and healthcare IT technologies, the companies announced on Monday.
• The partnership between the academic medical center and Japan-based Canon will include creating a comprehensive imaging research center in Cleveland.
• Joint research projects will focus on pre-clinical imaging, human imaging and image analysis in the clinical areas of cardiology, neurology and musculoskeletal medicine, per the release.

Dive Insight:

The new partnership between Cleveland Clinic and Canon comes as the healthcare industry grapples with new-age technologies like artificial intelligence. Imaging is seen as one logical area of application in the near term, given algorithms can be trained on reams of available data.

Studies suggest that AI may improve the accuracy of cancer screening, for example, while reducing workload on radiologists, though experts caution AI may not be ready to be used as an autonomous diagnostic tool.

Marrying Cleveland Clinic’s biomedical research and clinical care experience with Canon’s imaging and precision manufacturing abilities should help the two “create breakthroughs in imaging,” Tom Mihaljevic, Cleveland Clinic CEO and president, said in a statement. 

Cleveland Clinic did not respond to questions on how much it’s investing in the co-development deal with Canon.

The clinic has been helping the state of Ohio steadily build out the Cleveland Innovation District, a $500 million public-private partnership designed to accelerate research and create jobs.

Since 2021, Cleveland Clinic has partnered with regional universities and hospitals to create 1,000 new jobs and open a new research center to store biologic samples. Cleveland Clinic also made a deal with IBM to install quantum computers on its campus.

The Cleveland Innovation District is one reason Canon elected to build its U.S. healthcare subsidiary in the city earlier this year as the company looks to grow its medical business, according to the release.

It’s not Canon’s first partnership with a U.S. healthcare system to look into new technologies: The company has been researching healthcare optics with Boston-based Massachusetts General Hospital and Brigham Women’s Hospital for 10 years.

Amazon Web Services generated significant buzz earlier this week when it announced HealthScribe, its own clinical documentation tool that uses generative artificial intelligence to summarize doctor-patient visits.

With the launch, Amazon joined a number of other tech companies including Microsoft in the space, jockeying for a share of the market as providers look for ways to cut documentation burden on physicians.

In an interview on the sidelines of the AWS Summit on Wednesday, AWS Head of Health AI Tehsin Syed told Healthcare Dive what differentiates HealthScribe from other medical notetakers, how the technology is expected to drive client demand and how Amazon is approaching pernicious accuracy, ethics and liability issues around generative AI in healthcare.

HEALTHCARE DIVE: Explain HealthScribe — how does the service work?

TEHSIN SYED: HealthScribe transcribes the conversation between a doctor and a patient. It identifies the speakers and segments the transcript. If you start with some chitchat, it’ll recognize, okay, this is not relevant to the clinical note. It extracts specific medical information — things like medications, tests and references to anatomy — to take those as structured elements. This is where the generative AI capability comes in. That information, and the large language model we’ve trained, is used to generate summary documentation, in the shape of chief complaint, history of present illness, assessment and plan.

So we take a Titan model — that’s an Amazon first-party model — and we do what’s called grounding. We adapt the model to this specific purpose of learning how to generate this kind of documentation.

Finally, we show the end user the transcript and the summary, and cite conclusions in the summary back to the dialogue. So it’s a really natural and easy review process for clinicians.

What differentiates HealthScribe from other clinical documentation tools, like Suki or Microsoft-owned Nuance, that also use generative AI?

SYED: HealthScribe is an API that Amazon is selling to its partners for them to provide an end user experience. That’s a very different business model. We’re saying, you don’t have to have all the machine learning expertise and all of the infrastructure that’s needed to manage a large language model.

AWS is going to do that part of the work, and maintain the security and privacy of the data. We provide this capability to anyone who wants to use it, and we have public pricing based on usage, so it’s clear what’s going on.

What we’re trying to do is say, whoever you are, whatever software builder you are, you get to market much faster with this capability. You can concentrate on the end user experience.

There’s also innovation in the technology itself. Some of the grounding techniques are patent-pending. Underlying HealthScribe itself — at a high level everyone’s using an LLM and whatever — but part of this is the expertise that we bring.

3M, Babylon and ScribeEMR have already said they plan to integrate HealthScribe. How is AWS forecasting client demand moving forward?

SYED: There’s a number of others who are interested. I absolutely anticipate new customers coming to the table who previously didn’t have the ability to do this [work] themselves. We’ve seen a lot of interest from software vendors, because we’re providing an API and you do have to have some expertise to build. When we talk to provider systems, they’re interested, and they usually ask who’s a good partner, and how do we work with them to incorporate this.

Can you share any accuracy rates for HealthScribe?

SYED: The best way to show accuracy and build trust in the system is the method of showing end users what in the summary came from the dialogue. I don’t think showing them an accuracy stat is going to help as much.

Internally, obviously, we use a number of approaches. Some are about factual completeness — is what was in the dialogue reflected in the summary? Did the model come up with something that wasn’t in the dialogue? There’s a couple other metrics we track internally but it’s not shared externally.

Will you ever share accuracy metrics externally?

SYED: I think we’re directly addressing the concern about quality by showing the user every time why a decision was made.

To play devil’s advocate, from the doctor’s perspective they have a visit with a patient and then a summary pops out of their computer. What if there’s an issue with the original voice-to-text software that’s reflected in the transcript after being run through AI? What if doctors review summaries at the end of the day, and don’t remember specifics of a patient visit so don’t catch errors? How is AWS thinking about staying responsible here?

SYED: This is part of why we’re announcing in preview, and we’re working with our partners to understand what’s necessary to do here. I don’t have a definitive answer for you. There’s a lot of complexity to it, right? You have an ambient listening device, but maybe it’s too far away, or the air conditioner’s too loud. It’s not as simple as HealthScribe sharing accuracy numbers, because there could be an issue with the recorded conversation that we’re getting.

I agree that there’s a lot of think about in doing this responsibly.

What we’re saying is here’s what we can do, and as HealthScribe is deployed in the workflow there are other things that our customers have to do to ensure it’s the right level of accuracy. We are very clear that it’s generating the summary but it is not automating the documentation. The idea is, this is a tool, and then the tool is applied in a workflow. And the workflow has a lot of those checks and balances in it.

What if there’s an issue with that workflow that later results in a patient getting improper care, resulting in a malpractice suit? What party is liable — AWS? AWS’ client? The physician? How is AWS approaching the liability issue here, given the use of generative AI in clinical settings is still very new?

SYED: The way we look at that is, we’re providing a capability that has to be incorporated in an end-to-end workflow, and that workflow has to deal with those aspects you’re talking about. It’s the vendor who’s incorporating the capability that has to make sure that workflow is appropriate, and the clinician also has to make sure.

I worked at Cerner a long time before this. The dictation thing has been around for a very long time. It’s the same thing, right? Is it accurate or not? So folks have mechanisms in place to handle the workflow around this. But across the board with AI, there’s lots of new issues.

Is AWS concerned that generative AI might be being implemented too quickly in clinical settings?

SYED: I don’t have an opinion on moving too quickly or not quickly enough. We work with our customers on very specific use cases. With HealthScribe, we’re iterating during this preview period to make sure it is actually fit for its purpose, and it meets criteria that would result in real use in a responsible way.

Dive Brief:

• GoodRx is adding insurance coverage information to its drug cost estimation platform for providers, in what the California-based digital health company says is a key differentiator for the fast-growing tool.
• The addition of real-time benefits check to Provider Mode makes GoodRx the only platform for clinicians to compare insurance prices, cash prices and manufacturer savings programs in one place, the company said.
• Since the launch of Provider Mode in October, over 550,000 healthcare providers have used the platform, and tens of thousands of additional users are being added each month, according to Akeel Williams, general manager of GoodRx Provider Mode.

Dive Insight:

Provider Mode allows clinicians to compare cost options between different drugs during patient visits, including between different methods of payment and drug alternatives in the same class, with the goal of helping providers make more informed prescribing decisions.

Providers can also use the platform to offer GoodRx coupons and other discounts from pharmaceutical companies before patients leave the doctor's office.

But real-time benefits check is the platform’s “biggest, most transformative feature to date,” Williams said.

When providers search for a drug on GoodRx’s platform and verify their identity using their national provider identifier, they’re prompted to enter the patient’s name, date of birth, gender and zip code. GoodRx has partnered with specialty pharmacy workflow company AssistRx on the benefits check, which then pings its network of insurers and pharmacy benefit managers to find that patient’s coverage information and sends it back to the platform.

The provider can then see how much that patient will pay for that drug under their insurance, and compare it to other options.

GoodRx’s goal is to create a comprehensive view across different payment options to remove guesswork around a medication’s cost, increase adherence for patients and relieve administrative burden for doctors, Williams said.

Real-time benefits check is able to surface a patient’s insurance information about 80% of the time, as certain plans don’t participate in the AssistRx network or might experience data blackouts, Williams said.

When GoodRx is able to generate the information, it is almost always accurate, according to Williams.

“As long as we have those inputs, and they're inputted correctly, you're gonna get an accurate view, right,” Williams said. “There's always a caveat that sometimes a coupon that someone may see on a website — by the time they go to a pharmacy, because you're dealing with billions of data points, there may be some inaccuracies there.” 

Currently, real-time benefits check is only available for brand and specialty drugs, though GoodRx is working to expand to generics, Williams said.

The company is also exploring additional capabilities for Provider Mode, including weaving in artificial intelligence and machine learning, though the Provider Mode GM said it’s too early to speak to specific use cases for the technology.

Provider Mode is free to providers. But by making the platform more attractive to clinician users, GoodRx is also increasing its revenue opportunities.

The platform makes money by contracting with pharmaceutical companies that want to integrate application programming interfaces and signup modules into the platform, Williams said.

The platform is also a source of revenue by serving as another referral point for GoodRx coupons.

GoodRx is paid through contracts with PBMs, either with a paid percentage of fees that PBMs charge to the pharmacy or a fixed amount for every prescription that’s filled from its discounted pricing. GoodRx is generally paid more if its coupons generate a higher volume of prescriptions over a payment period.

GoodRx has sought out new avenues to connect patients to its coupons, including through deals with PBMs.

In July, GoodRx partnered with CVS Caremark, the largest PBM in the U.S., to automatically apply GoodRx coupons for CVS commercially insured customers filling generic prescriptions at eligible pharmacies.

GoodRx has experienced mixed financial results over the past year. The company posted a profit of $58.8 million in second-quarter results announced in June, after losses ranging from $1 million to $42 million in the previous four quarters.

Dive Brief:

• IBM on Monday unveiled the first quantum computer solely dedicated to healthcare research on-site at Cleveland Clinic.
• The IBM Quantum System One is also the first IBM-managed quantum computer in the U.S. not at one of IBM’s facilities, according to a release on the news.
• Academic medical giant Cleveland Clinic and IBM started a 10-year partnership in 2021 focused on advancing biomedical research through technology, including quantum computing and artificial intelligence.

Dive Insight:

Hospitals looking to leverage their reams of patient data for research and development have increasingly inked deals with technology companies. Cleveland Clinic and IBM signed their deal two years ago, which revolves in part around quantum computing, a faster and futuristic way of processing data.

The goal of the partnership is to streamline data collection and analysis to speed research into viruses and genomics, among other areas like population health, and spur the development of new tools and therapies for a variety of diseases.

The joint IBM-Cleveland Clinic venture also investigates new approaches to public health crises and looks for proactive ways to head off new pandemics, the companies said when the partnership was announced.

The partnership, which includes the use of two quantum computers from IBM, has resulted in multiple projects leveraging quantum computing in healthcare.

Those include developing quantum computing pipelines to screen drugs targeted to specific proteins; improving prediction models for cardiovascular risk following surgery; and applying AI to search genome sequencing findings and large drug-target databases to pinpoint existing drugs that could help patients with Alzheimer’s and other diseases.

Cleveland Clinic CEO Tom Mihaljevic in a statement called the unveiling a “pivotal milestone” in the academic medical center’s partnership with IBM.

Cleveland Clinic’s investment in installing the computer onsite is part of the $300 million commitment the system is making into the Cleveland Innovation District, a spokesperson said. The Innovation District is a project launched in January 2021 with three hospital systems partnering with two universities on research and new projects.

IBM also plans to install a more powerful next-gen quantum system at Cleveland’s campus in roughly three years, though those computers are still in development.

Quantum computers process information in a fundamentally different way than current computers, allowing them to test multiple solutions to a single problem at the same time. That results in exponentially quicker processing speed and faster results, which could go far in expediting the lengthy processes involved in medical research and the development of new pharmaceuticals.

Currently, research suggests it takes an average of 17 years to get a drug to a patient from the moment of scientific discovery.

Along with streamlining clinical trials, quantum computing could optimize back-end functions for payers and providers, saving hundreds of billions of dollars. Experts expect quantum computing to be used in practice as early as the next few years.

Dive Brief:

• On Monday, the HHS unveiled the first six networks that have been approved to be onboarded as qualified health information networks, or QHINs, under TEFCA, the government’s framework for a nationwide health information exchange.
• It’s been about a year since the Office of the National Coordinator for Health IT released TEFCA, or the Trusted Exchange Framework and Common Agreement. Now, Epic, CommonWell Health Alliance, eHealth Exchange, Health Gorilla, Kno2 and Konza — organizations that collectively cover a significant swath of American health records — have committed to become eligible and go live within TEFCA in 12 months.
• A number of additional organizations are readying themselves to apply into the voluntary framework, said Mariann Yeager, CEO of the Sequoia Project, ONC’s private-sector coordinating partner for TEFCA, at a Monday HHS event. “This is just the beginning,” Yeager said.

Dive Insight:

Interoperability is critical for national healthcare infrastructure, HHS officials said Monday, and improving it will bring down costs while also improving care delivery.

Bringing the new prospective QHINs on board is a great start to improving the U.S. healthcare systems’ interoperability, but there’s a lot more work to do to address the digital divide between well-resourced and struggling providers, a lack of connectivity with public health agencies, sparse information sharing between payers and providers and little patient access to their own information, ONC head Micky Tripathi said.

“Our vision is that TEFCA can get us out of the collective shared helplessness that we’re in,” Tripathi said.

The 21st Century Cures Act passed in 2016 required the government to create a set of foundational principles for health information exchange, under a contract establishing a technical infrastructure model and governing approach.

TEFCA’s goal is to create a simplified and standardized connectivity infrastructure for providers, plans, patients and public health agencies. The effort builds on the progress of national networks, state and regional health information exchanges that facilitate secure exchanges of millions of medical documents each day.

The Biden administration early last year finalized TEFCA and opened a window for organizations to apply to be designated as QHINs, or groups of organizations that agree to the same data sharing infrastructure. That connects them to one another and enables their participants, including providers, payers and public health agencies, to exchange health information across the country.

The six potential QHINs unveiled Monday have 12 months to be onboarded, but that work could be done by the end of 2023, Tripathi said. Some of the QHINs, including electronic health record giant Epic, had already announced their intention to join.

The number of QHINs isn’t set in stone. An HHS spokesperson told Healthcare Dive they “continue to receive interest from a diverse range of organizations,” including health information networks and EHR vendors.

But the six organizations alone cover a significant number of Americans. Though it’s difficult to pin down an exact number given the overlap in covered lives, collectively the QHIN applicants have networks that cover most U.S. hospitals and tens of thousands of providers, and process billions of transactions annually across all fifty states, the ONC said.

Moving forward, the ONC plans to announce additional QHINs when they're designated.