Showing posts with label Medtronic. Show all posts
Showing posts with label Medtronic. Show all posts

Thursday, 12 November 2015

Princess Health and "Dreaming On" - The Illusions of the Leaders of Large Health Organizations, as Illustrated by Medtronic's Founder. Princessiccia

Princess Health and "Dreaming On" - The Illusions of the Leaders of Large Health Organizations, as Illustrated by Medtronic's Founder. Princessiccia


On Health Care Renewal, we have posted story after story about amazingly well paid leaders of big organizations presiding over amazingly bad organizational behavior (including subversion of mission, conflicts of interest, deception, fraud, kickbacks, various other crimes and outright corruption).  Yet the leaders often seem curiously disconnected from what occurs on their watches, while they are sometimes hailed as "visionaries," and at times exude messianic confidence.

Medtronic's Founder on its Sacred Mission

A recent article appearing in an unexpected place provides an example of leaders' excess confidence in their own righteousness.  In the IEEE (Institute of Electrical and Electronics Engineers) Institute was a commentary by Earl Bakken, the founder of medical device/ biotechnology giant Medtronic, modestly proclaiming the "secrets of corporate success."

Keep in mind that while Mr Bakken founded the company, at age 91, while no longer its leader, he proclaimed, " I stay involved with my company."  As such, he remains proud of its mission statement,

In 1960, when corporate mission statements were rare, I wrote one that has never changed. It remains the company�s guiding principle. There are six tenets, but the first one is the most important: To contribute to human welfare by application of biomedical engineering in the research, design, manufacture, and sale of instruments or appliances that alleviate pain, restore health, and extend life.

Starting in the 1970s, I met with all new employees, explained our history and mission, and in each of their hands I placed a medallion imprinted with the mission statement. I encouraged them to live by it�at work and at home.
Note that the official mission also includes,

To strive without reserve for the greatest possible reliability and quality in our products; to be the unsurpassed standard of comparison and to be recognized as a company of dedication, honesty, integrity, and service. [ital added]

Apparently, he believes that under the "visionary leadership" and "astute direction" of the current, this mission remains central to the organization.

At Medtronic, we live our mission. It�s the basis for how we behave in relationship to our stakeholders, each other, our communities, and the world. But it also guides our relationships with ourselves. We live the Medtronic Mission every day in truly genuine ways by serving others. I am proud to have a mission that is so deeply woven into the fabric of this company that improves millions of lives throughout the world.

Here�s to dreaming on.

Honesty? Integrity? - the Company's 10 Year Track Record 

I hate to disillusion a 91-year old, but in light of the company's last 10 year track record, as discussed on Health Care Renewal, he does appear to be in a dream world.


Medtronic has provided our blog with lots of material, including some amazing stories about conflicts of interest (starting in 2006, here, here, here, here, here, here, here, here, nad here,) and revolving doors  (here, here, here, and here). 

The company has also made a series of legal settlements of various allegations of infamous behavior, in chronological order...
 
2006

- We discussed detailed and vivid allegations that Medtronic had been paying off doctors starting in 2003.
 - Medtronic subsidiary Sofamor Danek settled for $40 million allegations that it gave kickbacks to doctors in the form of sham consulting fees and lavish trips (look here).

2007

As Bloomberg summarized in 2014,
Medtronic agreed in 2007 to pay about $130 million to settle consumer suits accusing the device maker of hiding defects in its defibrillators.
 2008

- Medtronic subsidiary Kyphon settled a suit for $75 million and signed a corporate integrity agreement for allegations that it defrauded Medicare through a scheme that lead to excessive hospitalization for patients who received the company's spine surgery device (link here)

2010

Per the Bloomberg 2014 summary again,
The company agreed to a $268 million settlement of suits in 2010 over allegations that fractured wires in another line of defibrillators caused at least 13 patient deaths.


2011

-  Medtroinic settled for $23.5 million two other federal lawsuits alleging it paid kickbacks to encourage physicians to implant its devices (look here).

2014  

In June, we discussed a settlement Medtronic made of allegations that  Medtronic gave kickbacks (that is, bribes) to doctors to get them to use its cardiac devices.

2015

In April, 2015 we discussed three settlements made by Medtronic:
- Its subsidiary EV3 settled old allegations that it coached hospitals how to overbill the US government for procedures using its products
- The company settled allegations it gave kickbacks to physicians to induce them to use its neuromodulation devices.
- The company settled allegations it lied to the US military about US origins of its devices.

(And by the way, we will not belabor the contrast between the statement's committment to "recognize the personal worth of employees," and the gargantuan payments made to certain employees, that is, the top managers, all who got over $3.5 million in 2014, and the "visionary" CEO, who got over $12 million, look here. )

Summary

Someone needs to wake up Mr Bakken.  He may still believe in the mission statement, and wish that it is central to his company.  However, the track record seems to suggest that the mission statement has been honored often in the breach.

Perhaps the problem is that Mr Bakken is really much more detached from the company he founded than he now admits.  However, I worry that this immensely positive spin suggests that he, like many other health care oragnizational leaders, live in some sort of bubble into which no negative karma is allowed to penetrate.  Thus convinced of their own innate goodness, they can provide no check on continuing manifestations of corporate greed, most likely with the solace of the own fortunes they build up. 

IMHO, we need to break up these huge health care organizations which have become so big that those who run them cannot be in touch with what really goes on.  We need to reestablish the accountablity of leaders, and no longer allow them to get credit for all the good that happens, and dodge responsibility for all the bad.  True health care reform would entirely transform health care leadership, so that it can become well-informed, supportive of the mission, unconflicted, less self-interested, honest, and certainly law abiding. 

Wednesday, 8 April 2015

Princess Health and Three More Settlements by Medtronic of Allegations of Deceptive Behavior, but No Umpire Says "You're Out". Princessiccia

Medtronic, the giant, previously US based device maker settled three lawsuits, all alleging deceptive practices, over three months in early 2015.  I will summarize the settlements in chronological order.

Medtronic Subsidiary EV3 Settled Suit Alleging it Coached Hospitals about How to Overbill Medicare

This was actually an old case, originally against a company that Medtronic bought out, but only settled this year, in February.  As reported by the Minneapolis Star-Tribune,


A Plymouth medical device company owned by Medtronic has agreed to pay $1.25 million to settle a federal lawsuit alleging that it wasted Medicare dollars.

The medical device company EV3 is settling a whistleblower�s claims that in 2006 and 2007, a company it acquired improperly coached hospitals across the country on how to overbill Medicare for minimally invasive procedures to remove hardened plaque from patients� arteries using one of its devices, called the Silver Hawk.

Specifically, former sales representative Amanda Cashi alleged that the company told hospitals that 80 percent of their patients for the Silver Hawk procedure should stay overnight in the hospital following an atherectomy, leading to higher Medicare payments. The promises of higher reimbursement were intended to drive sales of Silver Hawk devices. Cashi and federal prosecutors who joined her lawsuit said most of the patients should have gotten lower-paying same-day procedures in an outpatient setting.

As is standard operating procedure for such litigation,

[Irish Medtronic subsidiary] Covidien, which negotiated the settlement agreement, is not admitting wrongdoing and specifically denies the allegations in the six-year-old lawsuit, the settlement agreement says.

'Medtronic is committed to the highest standards of ethical conduct, and we take responsibility for delivering outstanding results to our partners, patients and colleagues,' a company statement said. 'The case relates to historical conduct that took place under Fox Hollow. � We are pleased to have the matter resolved.'

Of course, there may be a bit of irony there, since I doubt that the original manufacturer of Silver Hawk, FoxHollow, or its successors were pushing to get the case resolved quickly, and Medtronic likely ultimately financially benefited from the prolonged delay. 

Note that in 2005 we first posted about the questionable clinical research data that FoxHollow used to promote the device

Medtronic Settled Suit Alleging it Gave Kickbacks to Doctors to Promote Unjustified Procedure that Used Medtronic Neuromodulation Device

Just two days later, the Star-Tribune reported,

Medtronic PLC will pay $2.8 million to the U.S. Justice Department to settle a false-claims case that alleged that the Minnesota devicemaker made illegal payments to doctors to recommend a medical procedure that was neither safe nor effective.

In particular,

The case surrounds allegations of corporate promotion of uses of a neurostimulation device that were not approved by the U.S. Food and Drug Administration. The Justice Department said Medtronic paid doctors in 20 states 'tens of thousands of dollars' to encourage health providers to use the device off-label.

This 'created a new, rapidly expanding market for their devices and a potentially huge source of profit for themselves at the expense of the federal Treasury,' the government said in a federal lawsuit.

As in the previous case, the settlement allowed Medtronic to deny "it did anything wrong."

Medtronic Settled Suit that Alleged it Sold Chinese or Malaysian Spinal Surgery Devices as Made in the USA

Finally, in April, 2015, the Star-Tribune again reported,

In its third federal settlement in two months, Medtronic PLC has agreed to pay $4.4 million to settle allegations that it deliberately violated U.S. law requiring that devices sold to the military be manufactured in the United States or its international trading partners.

The False Claims Act lawsuit, handled by Minnesota U.S. Attorney Andrew Luger�s office, alleged among other things that the formerly Fridley-based med-tech company brought spinal surgery devices in from China and then relabeled them 'Manufactured in Memphis, TN,' where its spinal division is based, before selling them to the government.

Of course,

Medtronic spokeswoman Cindy Resman said that although the company has since improved its country-of-origin disclosures in government contracts, it 'makes no admission that any of its activities were improper or unlawful.'

The settlement focused on 'a limited number of accessories and surgical instruments used in spinal surgeries that were provided to Medtronic by third-party suppliers and were manufactured in China or Malaysia. The overwhelming majority of Medtronic�s products are manufactured in the United States or its trading partners, such as Mexico or Ireland,' she said in an e-mail.

But can you believe them now?

Discussion

Medtronic made three settlements over three months, all of allegations that it deceived, directly or indirectly, doctors, patients, or the government.  These settlements were not isolated events.  In June, 2014 we discussed a settlement Medtronic made of allegations that  Medtronic gave kickbacks (that is, bribes) to doctors to get them to use its cardiac devices.  Previously, as we noted then, ...   As Bloomberg summarized,


 Medtronic agreed in 2007 to pay about $130 million to settle consumer suits accusing the device maker of hiding defects in its defibrillators. The company agreed to a $268 million settlement of suits in 2010 over allegations that fractured wires in another line of defibrillators caused at least 13 patient deaths.

In fact, Medtronic has provided our blog with lots of material.  We first discussed detailed and vivid allegations that Medtronic had been paying off doctors starting in 2003 here in 2006.  Medtronic has been involved in other lawsuits alleging various kinds of deception.
-  In 2011, it settled for $23.5 million two other federal lawsuits alleging it paid kickbacks to encourage physicians to implant its devices (look here).  
- In 2008, Medtronic subsidiary Kyphon settled a suit for $75 million and signed a corporate integrity agreement for allegations that it defrauded Medicare through a scheme that lead to excessive hospitalization for patients who received the company's spine surgery device (link here)
- In 2006, Medtronic subsidiary Sofamor Danek settled for $40 million allegations that it gave kickbacks to doctors in the form of sham consulting fees and lavish trips (look here).

One loses count of all the settlements and cases in which Medtronic was accused of deceptive practices.  Some settlements were for larger amounts, some for smaller.  Yet none of the settlements were large enough to really affect a company which reported earnings of just under $1 billion in 2014 (per this WSJ article.)   None of the later legal settlements seem to have taken into account the company's previous record.

But this is typical of how legal settlements made by large health care corporations are handled.  Almost never is the settlement big enough to have deterrent value.   

The revenues of the company could very well have been increased by the activities alleged to have occurred in the course of this litigation, and these revenues were likely used to justify outsize compensation for top corporate managers.  According to the company's 2014 proxy statement, in fiscal 2014, CEO Omar Ishrak got $12,118,846 in total compensation.  All other listed executives got at least $3.5 million.  In none of these cases did anyone at the company who might have authorized, directed, or implemented bad, and particularly deceptive behavior suffer any negative consequences.   

But this is typical of the impunity seemingly granted to top health care organizational managers.

In baseball, it's three strikes and you're out.  For the leaders of big health care corporations, however, no matter how many strikes your company makes, you never seem to be out.  Despite a continuing stream of ethical issues occurring on their watch, management usually succeeds in becoming filthy rich.


Maybe that would change if the public, or health care professionals, knew all about such things.  However, these settlements remain anechoic.  Although the latest Star-Tribune article did note that the latest 2015 settlement occurred after two previous settlements this year, none of the reporting about these settlements seems to have noted all the previous settlements.  Finally, the discussion of these cases involving a prominent device company and multiple allegations of deceptive, dishonest, unethical behavior never seems to go beyond business sections of media outlets.  Even though such continuing dishonest behavior could have corrosive cumulative effects on health care ethics, the morale of health professionals who have to deal with such deception, and patients' and the public's health, discussion of it never makes it into the medical and health care literature, a striking example of the anechoic effect.

Maybe if more health care professionals, and the public at large, knew the story better, they might ask what sort of stewardship was exerted by the Medtronic board of directors? Maybe they could ask current Medtronic board members, like Rensellaer Polytechnic Institute President Shirley Ann Jackson, and  former US Secretary of Health and Human Services Michael O Levitt,  and former board members, like Dr Victor J Dzau, who was pressured to leave the Medtronic board after he became President of the Institute of Medicine and this membership was noticed (look here)  These board members were making over $200,000 a year, and piling up Medtronic stock, supposedly for exerting stewardship over the company.

But typically board members of big health care organizations remain unaccountable.  

There seems to be increasing recognition that the continuing rise in US health care costs is unsustainable, and that these costs are not buying us good health care.  There are calls to avoid unnecessary, and sometimes harmful care.  Yet there is a persistent disconnect between how continuing dishonest behavior by health care organizations, impunity of their leaders, and lack of accountability by their board members fuel rising costs, shrinking access, and bad outcomes for patients.

To truly reform health care, we will have to at least recognize the causes of the current dysfunction.  Recognizing how health care dysfunction is created by unaccountable, dishonest leadership should lead to true reform that would promote well-informed, honest, accountable leadership that puts patients' and the public's health ahead of personal gain.  

Monday, 2 March 2015

Princess Health and Turn, Turn, Turn - Another Health Care Revolving Door Update. Princessiccia

Princess Health and Turn, Turn, Turn - Another Health Care Revolving Door Update. Princessiccia

It has been a while since our last revolving door update, so it's time to take another spin.


Summary of the Revolving Door Phenomenon

Before we get to some cases, though, let me summarize an important article on the revolving door that came out since.  This was published by U4, the "anti-corruption resource center" NGO based in lovely Bergen, Norway.  The title was "The Revolving Door Indicator: Estimating the distortionary power of the revolving door."  Although it's main point was to summarize a new measure the importance of the revolving door in a particular economic sector, it started with a very useful summary of the revolving door phenomenon.  It included a useful definition

According to Transparency International UK, the term 'revolving door' refers to 'the movement of   individuals between positions of public office and jobs in the private sector, in either direction.'

To expand,

The revolving door involves two distinct types of movement.  The first is from the public to the private sector, as regulators (ministers, cabinet secretaries, legislators, high-level officials, advisers) leave the public sector to enter the private sector they have regulated. The second is from the private to the public sector, as high-level executives of regulated companies enter the executive branch, the legislature, or key regulatory agencies.

It also included some idea of prevalence

The revolving door is particularly common in countries where explicit bribes cannot be paid safely, and thus regulators look forward to future employment with the regulated firms

We will discuss what the U4 report said about the implications of the revolving door after a quick review of the cases we have run across since May, 2014, involving the US government.  They will be listed in order of their appearance in the news.

Former National Coordinator for Health Information Technology and Colleague at ONC to Aledade (Company Supporting Accountable Care Organizations)

In June, 2014, various versions of this story appeared.  The Modern Healthcare version stated,

Dr. Farzad Mostashari, former head of the Office of the National Coordinator for Health Information Technology, is starting a new firm, Aledade, to help independent primary-care physicians form accountable care organizations. The startup has $4.5 million in seed funding from venture capital firm Venrock.

Independent practices looking to form ACOs have to expend money 'to hire the people, to get the agreements, to get the licenses, to do the legal work, to hire the executive director, and a medical director, practice transformation, the analytics software, the data warehousing, the EHR interfaces,' he said. 'All of that takes money,' often $1 million to $2 million.

Note that the current concept of the "accountable care organization" [ACO] includes heavy dependence on the electronic health records (EHRs) and other health information technology that Dr Mostashari had been so vigorously promoting as head of the ONC, so this transition seems to fit the revolving door rubric.

It also turns out that one of Dr Mostashari's former ONC colleagues was already at Aledade  

Mostashari will be joined by Mat Kendall, a former leader with the regional extension center program at ONC, who will be executive vice president

Former US Senators to Lobby for Medtronic and Covidien

In August, 2014, per Bloomberg,

Former U.S. Senators Trent Lott and John Breaux are part of a lobbying effort by companies that want to preserve the option of reducing their corporate taxes by moving their legal addresses overseas.

Nine U.S. companies that have sought cross-border mergers for tax reasons, are considering doing so or are targets of such deals have been pressuring lawmakers since April on legislation to stop the practice, federal disclosure reports show.

They include Medtronic Inc., the Minneapolis-based company that is seeking to acquire Dublin-based Covidien Plc. Medtronic paid Breaux-Lott Leadership Group $200,000 in June to block legislation from moving forward. Breaux, a Democrat, was once a member of the Senate Finance Committee. Lott, a Republican, is a former Senate majority leader.

Note that as Senator, Breaux had an important role in health policy, particularly the passage of the Affordable Care Act (ACA).

Former Assistant Secretary of Health and Human Services to Drinker Biddle & Reath (Lobbying Firm)

In August, 2014, per the Washington Post,

District Policy Group, the lobbying unit of law firm Drinker Biddle & Reath, is experimenting with a new model of using outside consultants to capture new business in the health-care field.

The group, which lobbies primarily on health-care policy, has taken the unusual step of forming an advisory board that includes external consultants. The outside advisers are not employees of the firm and instead receive a consultant�s fee, which means the firm does not have to pay their salary or benefits, but can still tout their services to clients.

The board was formed in July and is made up of four Drinker Biddle attorneys and two outside consultants, Tracy Sefl, a Democratic communications strategist, and Michael O�Grady, a health economics specialist and former Health and Human Services assistant secretary under President George W. Bush. Both Sefl and O�Grady have day jobs running their own consulting shops.

This seems to require no further comment.

Former Federal Trade Commissioner to Herbalife

In October, 2014, per the Hill,

Herbalife has hired a former federal regulator to run its compliance program as it deals with allegations of running a pyramid scheme.

Pamela Jones Harbour, who served at the Federal Trade Commission (FTC) from 2003 to 2010, has been named the company�s senior vice president of global member compliance and privacy, according to media reports.

The FTC opened a probe into Herbalife�s business practices earlier this year after lobbyists, interest groups and policymakers asked for a review.

Shortly after the FTC announced its investigation, the FBI began looking into how the direct-selling company recruits new distributors.

Herbalife is best known for its meal-replacement shakes and dietary supplement products. Harbour says she has been a Herbalife customer since 2004, according to Reuters, favoring the company�s Formula 1 shake mix.

Note that the FTC devotes considerable energy to health care issues, and Herbalife styles itself a "a global nutrition company" which makes "weight management" and "energy and fitness" products.

Director of US Centers for Disease Control and Prevention (CDC) to Merck as President of Merck Vaccines, then Executive Vice President for Strategic Communications, Global Public Policy and Population Health

In December, 2014, per a news release on BusinessWire,

Merck (NYSE:MRK), known as MSD outside the United States and Canada, today announced the appointment of Dr. Julie Gerberding, 59, as executive vice president for strategic communications, global public policy and population health, effective Dec. 15. In this newly created Executive Committee position, Gerberding, who most recently served as president of Merck Vaccines, will be responsible for Merck�s global public policy, corporate responsibility and communications functions, as well as the Merck Foundation and the Merck for Mothers program.

Note that

Prior to joining Merck, Gerberding served as director of the U.S. Centers for Disease Control and Prevention (CDC) from 2002-2009 and before that served as director of the Division of Healthcare Quality Promotion.

From UnitedHealth (Optum Subsidiary) Executive to Administrator of the Center for Medicare and Medicaid Services (CMS) of the Department of Health and Human Services

In January, 2015, per the Business Journals,

Marilyn Tavenner's replacement at the Center for Medicare and Medicaid Services is a former executive at one of the contractors for the initially botched HealthCare.gov insurance exchange.

Andy Slavitt, former group executive vice president of United Health Group's Optum unit, joined CMS last June to help fix HealthCare.gov. Now he'll be acting administrator of CMS.

An Optum subsidiary, Quality Software Services Inc., was one of the original contractors for HealthCare.gov. QSSI developed the exchange's data services hub and a registration tool that allows users to create secure accounts.

Apparently nothing succeeds like failure.


Discussion

I apologize for the somewhat desultory way I have been summarizing health care revolving door cases.  My excuse is that such cases are almost never publicized as such.  Most of the stories above were found when looking for something else.  Despite its potential importance, the revolving door phenomenon gets little consistent coverage in the news media, and the particular issue of the revolving door affecting health care is particularly anechoic.  (If one searches for "'health care revolving door," one finds discussion of patients who are frequently re-admitted to the hospital.)  There is one website devoted to the revolving door affecting the US government, (OpenSecrets.org has a database here.)   However, it is not searchable by sector, and seems not to be complete (that is, for example, it fails to contain most of the cases I listed above). 

None of the cases above got more than minimal media coverage, yet they all involved people who at one time held high government positions, including US Senators, director of the Centers for Disease Control and Prevention (CDC), a Federal Trade Commission (FTC) commissioner, the director of Center for Medicare and Medicaid Services (CMS) within the US Department of Health and Human Services (DHHS), an Assistant Secretary of DHHS, and the National Coordinator for Healthcare Information Technology. So the anechoic effect persists regarding this issue.

Yet the revolving door is a significant issue.  As discussed in the U4 article

The literature makes clear that the revolving door process is a source of valuable political connections for private firms. But it generates corruption risks and has strong distortionary effects on the economy, especially when this power is concentrated within a few firms.

Also, the principal way the revolving door can benefit a company is...

The rent-seeking channel: The revolving door is used to capture public resources, through legal and illegal means, rather than to increase production or efficiency.  Transparency International UK (2011) and the OECD (2009) point out that the revolving door may lead to various schemes involving conflicts of interest, both during and after a regulator�s term in public office. This in turn generates undue bureaucratic and political power for firms using such schemes

Furthermore,

The revolving door is also related to lawful behaviours (Brezis 2013), termed 'legal corruption' by Kaufmann and Vicente (2011). This phrase refers to 'efforts by companies and individuals to shape law or policies to their advantage, often done quasi-legally, via campaign finance, lobbying or exchange of favors to politicians, regulators and other government officials. [�] In its more extreme form, legal corruption can lead to control of entire states, through the phenomenon dubbed �state capture,� and result in enormous losses for societies'

So,

Firms connected through the revolving door may therefore derive undue advantages by legally and illegally influencing the formulation, adoption, and implementation of laws, regulations, and public policies. For example, when firms are connected to (former) members of Parliament [or the legislature], they may influence the enactment of laws and regulations in their favour. When firms are connected to (former) ministers [or in the US, cabinet secretaries] and their advisers, they may influence the upstream formulation and implementation of policies and regulations in their favour. When firms are connected to (former) high-level officials, they may influence the downstream implementation of regulations in their favour.

Finally,

Empirical studies suggest that the revolving door gives firms political and bureaucratic power that enables them to divert state resources by biasing public procurement processes (Goldman, Rocholl, and So 2013; Cingano and Pinotti 2013), obtaining preferential access to public finance (Faccio, Masulis, and McConnell 2006; Boubakri et al. 2012), and unduly benefiting from tax exemption, arrears, and subsidies (Faccio 2010; Slinko, Yakovlev, and Zhuravskaya 2005; Johnson and Mitton 2003).

Therefore, firms politically connected through the revolving door tend to shape laws and regulations in their favour and to divert state resources to their own benefit. They are unlikely to gain a productivity advantage, and indeed may reduce productivity in the private and the public sectors. The literature on state capture and political influence (Hellman and Kaufmann 2004; Hellman, Jones, and Kaufmann 2003; Slinko, Yakovlev, and Zhuravskaya 2005) supports the thesis that such distortions result from the high concentration of political and bureaucratic power among a few powerful firms.
That all suggests that the revolving door in health care ought to get attention beyond posts in Health Care Renewal, but so far there has been precious little of that.  The continuing egregiousness of the revolving door in health care shows how health care leadership can play mutually beneficial games, regardless of the their effects on patients' and the public's health.  Once again, true health care reform would cut the ties between government and corporate leaders that have lead to government of, for and by corporate executives rather than the people at large

Thursday, 5 February 2015

Princess Health and Outsize Compensation for "Teflon-Coated" Executives  - After Many Lawsuits and Negative News Stories, Norton Healthcare Executives Still Get Millions. Princessiccia

Princess Health and Outsize Compensation for "Teflon-Coated" Executives - After Many Lawsuits and Negative News Stories, Norton Healthcare Executives Still Get Millions. Princessiccia

In an earlier era of chemistry, politicians who continued to acquire votes while shedding doubts, criticisms, and allegations were called "Teflon-coated."  Teflon may be outdated now, but there certainly seems to be some health care executives who have unique non-stick coatings.

The Executives' Compensation

Our latest example comes from the Louisville (KY) Courier-Journal, which just published an article about the compensation received by top executives of one of the region's major hospital systems.  The essentials were:

From 2011 to 2013, the three most recent years available, tax records show the chief executive of Norton Healthcare, Stephen A. Williams, received total compensation that averaged $3.2 million a year.

The yearly numbers were:

2013: $2,447,122
2012: $4,705,333
2011: $2,376,186

Other top executives also were paid handsomely,

The tax reports show Norton paid chief operating officer Russell Cox an average of $1.5 million annually over the three years and chief financial officer Michael Gough $1.2 million. Cox also was promised an average of $547,580 annually over those years in additional future compensation and Gough $375,567 a year.

The Usual Talking Points as Justification

The justification given for such munificent pay for top hired managers of non-profit organizations that are supposed to put patient care (and sometimes teaching and research) ahead of personal enrichment never seems to go beyond the talking points we have previously discussed.

 It seems nearly every attempt made to defend the outsize compensation given hospital and health system executives involves the same arguments, thus suggesting they are talking points, possibly crafted as a public relations ploy.   We first listed the talking points here, and then provided additional examples of their use here, here here, here, here, and here, and here

They are:
- We have to pay competitive rates
- We have to pay enough to retain at least competent executives, given how hard it is to be an executive
- Our executives are not merely competitive, but brilliant (and have to be to do such a difficult job).
True to form, per the Courier-Journal article,

Industry leaders � and Norton board members � say the salaries and bonuses are essential to attract and retain executives with the skills to run complex organizations as they navigate enormous reimbursement and regulatory changes. Norton operates five hospitals and has revenues of about $1.8 billion.

In an interview, Hank Robinson, Norton's finance committee chairman and former board chairman, said Williams' compensation is 'very fair, very competitive and appropriate.'

So there, in three sentences, were direct versions of the "competitive rates," and "retention" talking points, and an indirect version ("skills to run complex organizations") of the "brilliance" talking point.

Also, the Courier-Journal article included,

Norton's chief communication officer, Thomas Johnson, points out that since Williams was named CEO, the company's revenues have climbed sixfold, and its work force has tripled to more than 12,000 employees, making it the third-largest employer in the Louisville area.

That was another indirect version of the "brilliance" talking point, since Mr Johnson seemed to be arguing that the CEO was the person most personally responsible for the "company's" [not "hospital system's?" - Ed)] increased revenue, regardless of the work of the more than 12,000 other employees.  Of course, Mr Johnson doubtless reports nearly directly to the CEO.

Pointedly left out of the discussion was that Norton Healthcare's financial performance in the recent years in which the CEO had received so much money was hardly brilliant.   As apparently first reported in Modern Healthcare in August, 2014, but going back to 2012,

A multimillion-dollar installation of an electronic health-record system dragged down Norton Healthcare's financials in 2012 and 2013, but the Louisville, Ky.-based health system rebounded in the first half of this year.

Norton�like many others racing to adopt the latest health information technology�began implementing an Epic Systems Corp. EHR in 2012. Norton's five hospitals and several physician practices fully converted to the Epic system by 2013. In total, the EHR cost nearly $80 million to install, according to Norton's audited 2013 financial documents (PDF).

According to Modern Healthcare, Norton had a $13.4 million operating loss in the first half of 2013.  However, Norton CEO Williams received nearly $2.5 million in 2013. So these negative financial results in 2012 and 2013 did not apparently drag down the CEO's compensation in those years.

Compared to What?

The Courier-Journal went a bit farther in their reporting of executive compensation at Norton Healthcare than other media outlets have when reporting on the pay of other health care leaders.  In particular, reporter Andrew Wolfson delved into how Mr Williams' compensation was justified by comparing it to the compensation of other health care CEOs.

The Norton finance committee chair, Mr Robinson

said it is derived through a rigid process based on an outside consultant's survey of pay at 66 comparable hospitals nationwide. The board then sets it at the 65th percentile of that compensation, which Robinson described as standard industry practice.

Furthermore,

Norton's consultant, Integrated Healthcare Strategies, says it looks at comparable peer groups � hospital companies, some larger and some smaller � to find a benchmark for Norton's board.

They include Baptist Health of Florida, whose CEO was paid $3.2 million in 2013, and Inova Health Care Services, of Falls Church, Va., whose top executive received total compensation of $4.2 million in 2012.

'Norton tries to set salary a little bit above the middle of the market,' Integrated's Dave York said in an interview. 'They are neither a conservative nor an aggressive payer.'


That still begged the question of why the compensation was "above the middle of the market," specifically, the 65th percentile?  Presumably, the board thought that CEO Williams has been at the 65the percentile of CEO performance.  But why did they pick that figure? What evidence is there that Mr Williams was better than average?

The Courier-Journal article also questioned the choice of the group of CEOs whose pay was used for comparison,


But Paul R. Dorf, managing director at Compensation Resources Inc., a Saddle River, N.J., consulting firm, who reviewed Norton's executive pay at the newspaper's request, said 'it doesn't seem right.
They are exceptionally well compensated,' he said.

The average compensation for the top 147 nonprofit hospital CEOs in 2012 was $2.2 million in 2012, according to Modern Healthcare, an industry publication.

Williams' average compensation from 2011-13 was more than paid in 2012 to the CEOs of 20 of the 25 top grossing nonprofit hospitals in the U.S., all of which were bigger than Norton, according to Becker's Hospital Review, another industry news outlet.

Given that compensation consultants like Mr Dorf usually seem to back the status quo for executive compensation, Mr Dorf's doubts should be underlined.  The Courier-Journal's coverage did suggest that the CEO and other top executives of Norton Healthcare are paid not only much more than the typical hospital employee, and the health care professionals who make the hospital run, but more than CEOs and top executives of other hospitals.  The reasons for this unclear.

Left unanswered were further questions.   Why are so called market comparisons limited to other CEOs or top managers, and never take into account other hospital employees, especially the health care professionals who actually provide the health care?  Why is the complexity of the managers' jobs never compared to complexity of other health care jobs, like the care of complex patients with multiple diseases, or neurosurgery, for example?  How is the "brilliance" of the managers measured, and compared to the brilliance of other employees, especially health care professionals?

Shedding Doubts, Criticisms, and Allegations

A little internet searching and dot connecting, however, did suggest that there may be one argument for the "brilliance" of the Norton Healthcare leadership, but it is an argument that the hospital system's board might not have been eager to make.

It seems, at least in my humble opinion, that the leadership has been brilliant, but brilliant in fending off multiple questions that have been raised in recent years about its management of the health care system, particularly questions about the ethics and integrity of their health care system's acts and practices. 

So far I have found the following issues, in more or less chronologic order,

Top Spine Surgeons' Questionable Royalties

In 2010, the Wall Street Journal reported that spine surgeons at Norton had been collecting millions in questionable royalty payments.

Norton Hospital in Louisville, Ky., may not be a household name nationally. But five senior spine surgeons have helped put it on the map in at least one category: From 2004 to 2008, Norton performed the third-most spinal fusions on Medicare patients in the country.

The five surgeons are also among the largest recipients nationwide of payments from medical-device giant Medtronic Inc. In the first nine months of this year alone, the surgeons�Steven Glassman, Mitchell Campbell, John Johnson, John Dimar and Rolando Puno�received more than $7 million from the Fridley, Minn., company.

Furthermore, Norton surgeons' use of spinal fusion for disc problems, a procedure whose benefits do not clearly outweigh its harms, was particularly notable.

At Norton, spinal fusions on patients who only suffered from aging disks accounted for 24% of the 2,475 fusions the hospital performed for Medicare between 2004 and 2008, compared with 17% nationally. This placed it 11th in percentage terms out of 60 hospitals that performed 1,000 or more spine fusions in those years, and fourth in raw count. Norton ranked third nationally in the overall numbers of spine-fusion surgeries.
Furthermore, the WSJ reported that it had obtained documents from a lawsuit filed by whistle-blowers against Medtronic which alleged


the five surgeons at Kentucky's Norton Hospital became Medtronic's biggest spine client [sic] after they signed consulting and royalty deals in early 2001.


We posted briefly about Norton's spinal fusion enthusiasts here, and Dr Howard Brody discussed it extensively on his blog, concluding,

some of my surgeon colleagues who actually care about professionalism and ethics believe that these 'royalty and consulting' payments are a huge cesspool. It's that much harder to get to the bottom of it because the device companies have been smart about how to cover their tracks.

Yet while there have been continuing questions raised about the actions of Medtronic vis a vis its medical "consultants" since then, it seems that no one has so far thought to question the role of Norton Healthcare, especially given that the hospital system doubtless collected millions for the performance of these procedures in its operating rooms.    

University of Louisville Litigation Claims Contract Violations, Debts Owed by Norton Healthcare

Apparently since at least 2013, Norton Healthcare has been involved in litigation with the University of Louisville over Kosair Children's Hospital, which is run by Norton on land owned by the University.  As summarized in Louisville Business First in October, 2013,

Norton Healthcare Inc. has filed a complaint in Franklin Circuit Court that seeks to establish that the University of Louisville has no legal right to evict the organization from Kosair Children�s Hospital.

Louisville-based Norton owns and operates Kosair Children�s Hospital on land it leases from the state.

U of L executive vice president of health affairs David Dunn issued this response late Friday to Norton's claim:

'It�s unfortunate that Norton filed a lawsuit instead of meeting to negotiate a long-term agreement for the care of children at Kosair Children�s Hospital. The University of Louisville�s repeated attempts to meet and negotiate have been rejected again and again by Norton�s CEO, who told us today that he will neither meet nor negotiate while their lawsuit is pending.'

'This is a disturbing trend in dealing with Norton as we try to resolve these complicated matters in a way that best meets the needs of Kosair Children�s Hospital, the patients we serve and U of L�s Department of Pediatrics. It is our hope that, later today, Norton will take a deep breath, accept our invitation to meet, and we all can focus on securing a long-term agreement to best serve the children of our community.'

Furthermore, the University of Louisville also demanded

that the hospital company rectify alleged violations  of a land lease and other agreements

In addition,

other claims in U of L's letter was that Norton owes U of L millions of dollars related to the Kosair agreements.

The dispute apparently also involves the University of Kentucky and the KentuckyOne hospital system. Some of the other relevant issues were summarized on the Kentucky Health Policy Institute website here.  It seems that patient care and medical education have become caught in the cross-fire between these powerful organizations. It is not obvious that Norton Healthcare is more or less responsible for this state of affairs than the other large organizations involved. However, neither is it obvious that Norton has taken the high ground regarding this matter.

Kosair Charities Sues Norton Healthcare for Misusing Charitable Funds

In mid-2014, another litigation front opened against Norton Healthcare.  As reported then by the Louisville Courier-Journal,

Kosair Charities, which has given more than $6 million annually to Kosair Children's Hospital, is accusing parent company Norton Healthcare of misusing some of that money to enhance its bottom line and 'line the pockets' of its executives.

In a lawsuit filed Thursday in Jefferson County Circuit Court, the charity says Norton has refused to provide an accounting of how Kosair's donations are spent.

'We have an obligation to the kids and our donors to make sure the money is being used to help children,' said Randy Coe, president of Kosair Charities, which is the hospital's largest donor. 'We don't want our money to go into the Norton pot.'
Note that the source of generous executive compensation at Norton Healthcare is a direct point of contention in this legal matter.


This lawsuit stems from the previously cooperative relationship between Kosair and Norton,

 At one time, Kosair Charities and Norton each operated their own pediatric hospitals � Kosair Crippled Children's Hospital and Norton Children's Hospital.

But in 1982, Kosair agreed to close its hospital on Eastern Parkway and to help pay for a new one downtown that was named Kosair Children's Hospital.

Kosair Charities said that, in an agreement struck that year, Norton agreed to keep separate accounts for the children's hospital in exchange for millions of dollars of contributions. Kosair says that arrangement was continued when the agreement was renewed in 2006.

In fact, the charges brought in this lawsuit about Norton executive compensation led the Courier-Journal to publish the 2015 article about the hospital system's executive compensation. Also, in 2014, Norton further belayed this previous spirit of cooperation by counter-suing Kosair, again as dutifully reported by the Courier-Journal. These lawsuits have not been resolved.


Patient Lawsuit Claiming "Unfair, False, Misleading or Deceptive Acts or Practices" by Norton

Also first reported in August, 2014, by the Courier-Journal, was a lawsuit by a patient who claimed that  in the emergency department of a Norton hospital,

he was seen only by a nurse practitioner who failed to diagnose that he was suffering from an acute and potentially fatal version of diverticulitis, an inflammation of the intestinal lining � and sent him home with a prescription for oral antibiotics. Two days later, he began vomiting and was rushed back to the hospital, where he underwent emergency surgery for a perforated bowel and was fitted with a colostomy bag.

However, that hospital had been advertising

 You don't just deserve emergency care. You deserve remarkable care.

This lawsuit, which alleges that Norton Healthcare violated a law prohibiting "unfair, false, misleading or deceptive acts or practices" by advertising "remarkable care," but delivering much less,  has not been resolved, either.

Summary

The 2015 report about executive compensation at Norton Healthcare raise the same points that many, many stories about executive compensation in health care have raised before.  Top managers/ administrators/ bureaucrats/ executives in health care seem to be paid ever increasing amounts, even as other employees, including health care professionals, work harder, burn out more frequently, and may be laid off.  These executives' payments rise faster than inflation, and are seemingly unrelated to the financial performance of the the relevant health care organizations, much less the health care quality provided, or the positive effects on patients' or the public's health

Yet the defenders of excess compensation seem to get away with repeatedly reciting the same tired talking points, without clear logic, and certain without evidence.

In the current case, however, one talking point, the argument that the pay was justified by the executives' hard work and "brilliance" may be justified, albeit in a somewhat twisted way.  Executives at Norton Healthcare have been fending off questions about the ethics and integrity of their system raised by a barrage of news stories and claims, including many for which litigation is in progress, claiming the hospital system engaged in a variety of allegedly deceptive or dishonest practices.  One might think that the doubts raised by these claims might have threatened the compensation of the executives on whose watch they occurred.  Instead, perhaps they got even more pay for being "brilliant," not so much brilliant at providing excellent health care, but brilliant at keeping all these doubts at bay for so long, without so far actually disproving any of them. 

As we have said before, in US health care, the top managers/ administrators/ bureaucrats/ executives - whatever they should be called - continue to prosper ever more mightily as the people who actually take care of patients seem to work harder and harder for less and less. This is the health care version of the rising income inequality that the US public is starting to notice.

Thus, like hired managers in the larger economy, non-profit hospital managers have become "value extractors."  The opportunity to extract value has become a major driver of managerial decision making.  And this decision making is probably the major reason our health care system is so expensive and inaccessible, and why it provides such mediocre care for so much money. 


One wonders how long the people who actually do the work in health care will suffer the value extraction to continue?

So to repeat, true health care reform would put in place leadership that understands the health care context, upholds health care professionals' values, and puts patients' and the public's health ahead of extraneous, particularly short-term financial concerns. We need health care governance that holds health care leaders accountable, and ensures their transparency, integrity and honesty.

But this sort of reform would challenge the interests of managers who are getting very rich off the current system.  So I am afraid the US may end up going far down this final common pathway before enough people manifest enough strength to make real changes. 

Friday, 14 March 2008

Princess Health and Hacking an ICD - A Dual Medical Informatics/Ham Radio Perspective. Princessiccia

Princess Health and Hacking an ICD - A Dual Medical Informatics/Ham Radio Perspective. Princessiccia

Roy Poses wrote at "Hacking an ICD" that:

An ICD is a device whose correct operation is critical for the health and safety of patients in whom it is implanted. One would think that the managers responsible for the design of such devices would have pushed to make sure that the operation of such devices could not be hacked or accidentally altered in ways that could put patients' health and lives at risk.

Indeed.

It is probably not well known that in addition to being a Medical Informaticist, I am also a ham radio enthusiast, licensed at the Extra class. I know more about electronics than most physicians - and most IT people in hospitals to boot, although that often didn't matter in the dysfunctional world of hospitals and health IT.

As a medical informaticist and ham radio operator, I am concerned by the possibility of long(er) range hacking of implantable medical devices than that accomplished by researchers recently.

Apparently ICD's use a frequency of about 175 kHz for data communications. 175 kHz is in a band known as longwave. For comparison and orientation, the bottom of the familiar medium wave band -- a.k.a. ordinary AM radio-- is 520 kHz.

(An aside for those interested: shortwave starts at about 1,800 kHz or 1.8 MHz and extends to about 30,000 kHz or 30 MHz, and is called "shortwave" for historical reasons; the actual wavelengths are appx. 160 meters to 10 meters. These wavelengths were considered "short", comparatively speaking, in the early days of radio. The shortwaves have the property, under proper conditions, of being refracted back to earth by the earth's ionosphere and can be reflected by the earth itself. This allows the waves to do "multiple hops" and propagate over great distances far in excess of line-of-sight, even around the world. Hence the ability of ham radio enthusiasts to talk to people all over the world on the shortwave bands allocated to them.)

When I was 13 years old I built a one-transistor transmitter on a cigar box from a plan by Heathkit that transmitted low power morse code at a frequency of about 550 kHz. It ran off a few AA batteries and used a short wire as an antenna. It was easily receivable on a radio across the house.

The first cordless phones ca. early 1980s, wireless baby monitors, and other devices operated at about 1,700 kHz, just above the AM radio band. They were very low power devices with short antennas relative to wavelength (~175 meters) but were usable at dozens of feet from their base units.

Using an antenna, say, the size of a CB whip (properly loaded electrically to resonate at 175 kHz, not very efficient but usable), or even better, a directional loop antenna, plus a transmitter of 5 or 10 or, perhaps, 100 watts of power (not very hard to build), and using a sensitive receiver designed for those frequencies (my $150 retail Grundig Yacht Boy is an example, http://www.eham.net/reviews/detail/816) with modifications and a suitable low-noise receiving antenna, would potentially extend the range of communications with RF-controlled implantable devices.

Not to miles with any type of portable equipment, I should add, due to efficiency issues with very short antennas (relative to wavelength) and the low power of the ICD's transmitter, but tens of feet might be possible. Throw in digital signal processing on the hacker's receiver, which is available via common, cheap, off-the-shelf DSP chips and algorithms, and even more range would be likely. You would be surprised at what a DSP-equipped and/or computer-enhanced receiver can pull out of the "ether" even under extremely poor signal conditions.

One wonders if any ICD's transmitter and receiver are encrypted in any way - apparently the devices tested were not. My car FOB is, although even those can be hacked (e.g., "Prius Security System Cracked", http://www.treehugger.com/files/2007/08/a_talk_given_at.php):

A talk given at the computer security conference, CRYPTO 2007, explained how the key-fob system installed on the Toyota Prius has been cracked. The KeeLoq auto anti-theft cipher is used in common devices made by Microchip Technology Inc, which are also used by Chrysler, Daewoo, Fiat, General Motors, Honda, Volvo, Volkswagen, and Jaguar. The attack requires that the thief gets within range of your RFID keyfob, in order to break the encryption. This could mean stealing your keys, or just sitting next to you in a cafe with a laptop. The cipher used in these devices is 64 bit, which has always been theoretically possible to break, but has now been shown to be breakable in about an hour. This is important, because the shorter the amount of time required with the key, the more likely this attack is to become used outside of a research lab.

May I add that while encryption is not foolproof, lack of encryption seems the work of fools.

On a somewhat unrelated note, you can buy a wrist watch that picks up time-setting signals from an atomic clock via station WWVB, Fort Collins, Colorado (http://en.wikipedia.org/wiki/WWVB) at long wave frequency 60 Khz for $30. I have one and in Philadelphia, it works well.

Some hams bounce signals off the moon for earth-moon-earth communications. They use high power, high gain antennas, and very low noise receivers. It works quite well.

Never underestimate what can be done at RF.

On one (predictable) industry response:

Medtronic's Rob Clark said the company's devices had carried such telemetry for 30 years with no reported problems. 'This is a very low-risk event for patients that have these devices,' Clark said in a telephone interview."

It would have been just a bit harder to hack a computerized device 30 or 20 or even 10 years ago. When kids can buy a laptop with computing power exceeding that of the Cray supercomputer for $500 and crack into, say, the Pentagon's systems, we are indeed living in different times.

Dr. Poses also wrote that:

The most charitable explanation for why they [the manufacturers] did not think to [engineer ICD's to be exceptionally hacker-proof] is that they really did not understand the clinical context in which this device would be used.


I think a better explanation is that the manufacturers' management has little imagination and underestimate the capabilities of people much smarter and more creative than themselves (e.g., tech-savvy kids). It would not surprise me to find engineering memos warning management that more safeguards needed to be incorporated, only to be asked "What's the ROI?"

The bottom line is: manufacturers might need to work a little harder when they deploy wireless devices, as hacking of gadgets and computerized equipment such as cell phones seems to be an increasingly common pastime for today's youth. (It's too bad ham radio is itself losing numbers as the previous generation ages and dies out.) The internet itself is used to spread techniques and malicious code among hackers.

One can imagine the consequences of a malicious RF device hacker or smart-but-delinquent kid in, say, a crowded shopping mall.

Finally, ham radio experimenters worldwide are not unfamiliar with longwave experimentation. Note in particular the bolded statement below:

With no Amateur Radio low-frequency [longwave -ed.] allocation in North America, stations operating under FCC Part 5 Experimental licenses in the US or under special experimental authorizations in Canada nonetheless continue to research the nether regions of the radio spectrum. By and large, LF experimentation is occurring in the vicinity of 136 kHz--typically 135.7 to 137.8 kHz--where amateur allocations already exist elsewhere in the world. The FCC rejected the ARRL's 1998 petition for LF allocations at 135.7 to 137.8 kHz and 160 to 190 kHz, however, after electric utilities objected that ham radio transmissions might interfere with power line carrier (PLC) signals used to control the power grid.

"Most of the new LF activity of Part 5 licensees has been in the shared 137 kHz amateur allocation available in some parts of the world," says low-frequency experimenter Laurence Howell, KL1X/5. "Although not in the Amateur Radio Service, these Part 5 experimental stations continue to add to our knowledge on propagation and engineering."

The holder of Part 5 Experimental license WD2XDW, Howell who's also GM4DMA, previously operated LF from Alaska. He's since relocated to Oklahoma, and has now resumed his LF work on 137.7752 and 137.7756 kHz. Already he's reporting some spectacular success, despite antenna limitations. On October 28, New Zealand LFer Mike McAlevey, ZL4OL, copied WD2XDW's 137 kHz carrier "bursts" over a path of more than 13,000 km (8000 miles).


The take-away message is that:

  • In biomedicine, the most meticulous resilience engineering is never a bad idea.

When drug and device manufacturers understand this fully, perhaps we will no longer have incidents of bad health informatics that can kill.

-- SS
Princess Health and Hacking an ICD. Princessiccia

Princess Health and Hacking an ICD. Princessiccia

Implantable cardiac defibrillators (ICDs) are battery-powered, computerized electronic devices implanted in the body. They are designed to detect dangerous heart rhythms and administer a shock to the heart to stop these them. We have discussed these devices before, including a story about how one manufacturer suppressed data that suggested some of their ICDs were less reliable than heretofore thought.

It appears that a new, and potentially worrisome adverse effect of these devices has just been discovered.

An article to be published in the IEEE Symposium on Security and Privacy [Halperin D, Heydt-Benjamin TS, Ransford B et al. Pacemakers and implantable cardiac defibrillators: software radio attacks and zero-power defenses. IEEE Symposium Security Privacy 2008; in press. Link here.] demonstrated the vulnerability of an implantable cardiac defibrillator to computer hacking.

Let me set the stage. ICDs, and other implantable devices may need to be tested, and sometimes their functional parameters need to be adjusted. Obviously, it would be cumbersome and hazardous to remove such a device after it was implanted to check and adjust it. So the devices incorporate methods to check and adjust them remotely. It appears most do so using "wireless" means. Wireless, of course, is the traditional UK term for radio.

Halperin et al found that they could communicate with a representative ICD, the Medtronic Maximo DR VVE-DDDR model via radio. Note that the ICD they tested was not implanted in a patient, but sitting on a bench, and that their radio equipment used to "hack" it was in close proximity to it.

Once they figured out how to communicate, the found that they could:
- Discover patient data such as name, date of birth, medical ID number, and medical history
- Monitor electrophysiological telemetry data
- Turn off specific ICD functions
- Induce the ICD to deliver a shock, potentially one that could cause a severe rhythmn disturbance
- Increase the power consumption of the ICD so that its battery would fail prematurely.

Further, they found that they could overcome a design feature of the ICD meant to prevent anyone from communicating with it from more than a very short distance. The ICD is not supposed to respond to radio signals unless it is first exposed to a strong local magnetic field which triggers a magnetic switch in the device. But the investigators found, "in order to rule out the possibility that proximity of the magnet ... is necessary for the ICD to accept programming commands, we tested each ... attack with and without a magnet near the ICD. In all cases, both scenarios were successful."

Thus, this article suggested this ICD could be hacked, and that hacking it could pose significant risks to patients who had the ICD implanted.

Some people doubted that such hacking could actually take place in real-life, as opposed to laboratory settings. For example, per the AP story, FDA spokesperson Pepper Long "acknowledged a hacker could use specialized software and a small antenna to intercept transmissions from a defibrillator. But she said the chance of that happening � or of a defibrillator being maliciously reprogrammed using a technique similar to the one a doctor would use to program it � was 'remote.'" Furthermore, per the Reuters story, "Medtronic's Rob Clark said the company's devices had carried such telemetry for 30 years with no reported problems. 'This is a very low-risk event for patients that have these devices,' Clark said in a telephone interview."

In my humble opinion, however, the problems that Halperin et al found with the Medtronic ICD have real importance. Let me first note that both the FDA and Medtronic representatives treated the issue epidemiologically. They based their pronouncements on the assumption that an adverse event that has not happened in the past due to a device in wide use is not likely to happen in the future. That does not make sense if the potential adverse event would involve conscious, malicious human action. Just because hackers have not yet attacked an ICD does not mean they will not do so in the future, especially after the possibility of doing so has gotten wide publicity.

Another way some have minimized the practical importance of their findings is that the experiment by Halperin et al was carried out on an ICD on a bench, using equipment that was in close proximity. Some may thus feel that the possibility of hacking carried out from longer range is low. I strongly believe that is not a good assumption. Many features of the ICD and its radio communication system suggest that hacking could be carried out from considerably longer range. There are hints in the Halperin et al article that could suggest to anyone moderately knowledgeable about radio how this could be done. I do not want to discuss these in any more detail, because I do not want to facilitate such long-ranging hacking. But I believe it is a real danger.

But why is this relevant to Health Care Renewal? It seems glaringly obvious that the risk of hacking could have been substantially reduced had the ICD been designed so it would not respond to any radio communication that did not have an appropriate authorization code, and/or if communication with it were encrypted. In fact, Halperin et al suggested some relatively simple measures that could be used to increase the security of these devices. Yet the Medtronic ICD, and presumably other ICDs and implantable devices, were not designed with such elementary security precautions in mind. As security expert Bruce Schneier wrote (reported in Information Week),

Of course, we all know how this happened. It's a story we've seen a zillion times before: The designers didn't think about security, so the design wasn't secure.

But an ICD is a device whose correct operation is critical for the health and safety of patients in whom it is implanted. One would think that the managers responsible for the design of such devices would have pushed to make sure that the operation of such devices could not be hacked or accidentally altered in ways that could put patients' health and lives at risk. The most charitable explanation for why they did not think to do so is that they really did not understand the clinical context in which this device would be used.

This is yet another reminder that those who run health care organizations often fail to think about patients' welfare first instead of other considerations. We need to change the culture of health care organizations to put patients first. Until we do so, we are going to get hacked.