Hacker News Reader

Comment by et2o | Hacker News Reader

I think there are two components to this:

First, HIPAA requirements are in part IT requirements. Every single hospital works really hard to comply with these, because there are huge fines if they don't. Some of the problems with hospital IT security might be due to defects in the already quite onerous HIPAA specification.

The second is that hospitals are extremely low-margin institutions. Most hospitals (even the really big ones) just break even, especially if they're teaching hospitals or serve poorer areas. IT security doesn't really produce any revenue.

I agree it's a problem. This needs a systemic solution–who would pay for IT fixes? Reimbursement is declining and government payment sucks. Most hospitals are in crisis mode as it is.

View on HN

Hospitals are low margin/break even because they choose to be - but that's another topic.

>IT security doesn't really produce any revenue.

Hospitals (and the health care industry at large) has been drowning in billions-with-a-B federal and state dollars since ARRA. All in the name of "meaningful use" of health information technology. HIT is very much a revenue model for hospitals.

http://healthaffairs.org/blog/2015/03/04/where-is-hitechs-35...

https://www.health.ny.gov/technology/efficiency_and_affordab...

http://www.hrsa.gov/ruralhealth/resources/healthit/

http://www.ehrinstitute.org/articles.lib/items/Grants-for-EH...

http://calhipso.org/news-and-updates/more-than-1-2-million-i...

###

* re: operating margins TIME magazine puts margins at an average operating margin of not-for-profit hospitals is 11.7 percent.

According to the AHA Annual Survey, the average operating margin of all hospitals was 5.5 percent in 2011.

So, the industry themselves declare 5.5% margin for non-profit hospitals, a healthy margin for any non-profit entity.

> Hospitals (and the health care industry at large) has been drowning in billions-with-a-B federal and state dollars since ARRA.

For the US Healthcare industry, billions-with-a-b (for the period since ARRA in 2009) in public funds isn't enough money to drown in. Its not even enough money to get noticeably damp -- its a $3.8 Trillion (annually) industry (something like, IIRC, 40% of which is public funds, so its not even all that big of a delta in public funds.)

Meaningful use for EHR is completely different from IT security practices. Additionally, payments for implementing new EHR systems are declining to zero; it was a temporary measure. I think you don't really understand what is implied by "meaningful use" measures.

It's also pretty misleading to use hospital payment data from 2011, pre-ACA, as reimbursement structure has changed massively in just a few years, massively altering hospital financial models.

I think both of my points stand.

Reply on news.ycombinator.com