HIM 560 Module 3 Final Project Milestone One Example

Final Project Milestone One: What We Run Today. A Current-State Infrastructure Assessment of Pelican Shoals Health

[Student Name]

Southern New Hampshire University

HIM 560: HIM Informatics and Technology Infrastructure

Final Project Milestone One

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone One: What We Run Today. A Current-State Infrastructure Assessment of Pelican Shoals Health

Pelican Shoals Health must replace its document imaging system within eighteen months, when the vendor ends support, and leaders have asked whether the hospital should use the occasion to rethink its wider technology. That question cannot be answered well without a clear view of what exists now. This milestone inventories the hospital's health information systems and the infrastructure beneath them, explains how they were assessed, rates each against six criteria and ranks the gaps that the next milestone's requirements must address.

Scope and Methods

The assessment covers systems that create, store or move patient information used by the health information department, together with the servers, network and backup arrangements that support them. Clinical systems such as pharmacy and radiology are included only where they feed the record through interfaces.

Three methods were used. Contracts, support notices and the IT asset list provided vendor and version information. Twelve interviews, with coders, release-of-information staff, clinic managers, nurses and the two IT analysts, explored how each system fits daily work. A walk-through of the server room, network closets and backup process checked what the documents said. Sittig and Singh (2010) argue that health IT must be judged across technical and social dimensions, so interviews carried as much weight as the asset list.

The Inventory

Table 1 summarizes the systems and supporting infrastructure found, with the rating assigned to each. Ratings of good, fair or poor reflect the six criteria described below.

Table 1. Current Systems and Infrastructure with Overall Ratings

Note. Prepared by the author from the asset list, contracts, interviews and a site walk-through.

Assessment Criteria

Each component was rated on six criteria. Vendor support asked whether security fixes and help are still available. Workflow fit asked whether staff can do their work without workarounds. Security asked whether access controls, patching and monitoring meet current practice. Resilience asked how quickly the component could recover from failure or disaster. Interoperability asked whether it can exchange data using current standards. Cost asked what it takes to keep it running, including staff time. A component rated poor on either vendor support or resilience was rated poor overall, because those failures can stop work entirely.

Findings: Resilience

The most serious findings concern resilience. The server room sits in the basement of the original building and took on water during a hurricane six years ago; the room has since gained a pump but not a new location. Nightly backups are written to disks in the same room, and only a weekly copy leaves the building, so a flood could destroy both servers and up to six days of backups. The NIST contingency planning guide recommends that organizations set recovery objectives through a business impact analysis and keep backups at a location not exposed to the same threats (Swanson et al., 2010). Neither step has been taken. Ransomware makes the gap more pressing: Neprash et al. (2022) counted ransomware incidents at hospitals, clinics and other care providers and found the yearly number more than twice as high in 2021 as in 2016, with care frequently interrupted, and disk backups on the same network can be encrypted along with the systems they protect.

Findings: Support and Interfaces

Two systems are near or past the end of vendor support. The imaging system's support ends in eighteen months, after which security fixes stop. Its retrieval is also slow: release-of-information staff reported waiting up to a minute for large charts and printing records to upload them manually to the outsourced portal. The interface engine's version is already unsupported, and only one analyst understands its configuration. When the dictation interface failed last spring, recovery depended on that analyst being reachable. Forty-two point-to-point interfaces also mean forty-two places where a change in one system can break another.

Findings: Workflow and Exchange

Interviews showed that most workarounds involve moving information between systems. Health information staff scan about 120 faxed pages a day from the clinics. Nurses print clinic notes for admitted patients. Coders open three applications to code one chart. Clinic managers described a single circuit outage last year that left one clinic without its record for most of a day, with appointments continued on paper. These workarounds cost staff time and create chances for error, and they point to interoperability and network redundancy as the areas where improvement would be felt most directly. Staff also described informal fixes that no document records, such as a coder who keeps a personal spreadsheet of charts awaiting late reports and a clinic manager who photographs the day's schedule each morning in case the circuit fails. These habits show where people have stopped trusting the systems.

Ranked Gaps

The gaps are ranked by their risk to patients and operations. First, backups and servers share a flood-prone location, and no recovery objectives exist. Second, the interface engine is unsupported and depends on one person. Third, document imaging will lose support within eighteen months. Fourth, the clinics cannot exchange data electronically with the hospital. Fifth, each clinic depends on a single network circuit. The encoder and the clinic record hosting are adequate for now.

Conclusion

Leaders asked about document imaging, but the assessment shows that the hospital's largest risks lie in where its systems and backups are kept and in an interface engine few understand. The requirements milestone will therefore treat imaging replacement as one part of a wider set of needs that includes recovery, integration and clinic connectivity.

References

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

Sittig, D. F., & Singh, H. (2010). A new sociotechnical model for studying health information technology in complex adaptive healthcare systems. Quality and Safety in Health Care, 19(Suppl. 3), i68-i74. https://doi.org/10.1136/qshc.2010.042085

Swanson, M., Bowen, P., Phillips, A. W., Gallup, D., & Lynes, D. (2010). Contingency planning guide for federal information systems (NIST Special Publication 800-34, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-34r1