Maximizing the Power of Centricity PACS Audit Data

1. Maximizing the Power of Centricity PACS Audit Data Bill Gregg, MS, CIIP, CPSA PACS Administrator/IIP LSU Health Sciences Center Shreveport, LA PARCA � PACS Administrators Registry and Certification AssociationPARCA � PACS Administrators Registry and Certification Association

2. The materials, presentations and content herein are the opinions and experiences, and represent the views, of the specific authors and presenters and are not statements of advice, opinion or information of GE Healthcare. Neither the materials, presentations nor content therein have been prepared, screened, approved, reviewed or endorsed by GE Healthcare.

3. Overview Start Simple Historical perspective Basic concepts regarding events and data Look at basic data with the PACS Auditor Finish up with workflow analysis Goal is to give everyone something to take home today

4. Getting Started HIPAA (2004) � audit access to PHI With Centricity 2.0 GE started providing XML audit log files Direct conversion of XML to Excel wasn�t working for me Wanted to work in the .NET environment Used Visual Basic .NET to read audit files and load into MS Access

5. Getting Started First version of the PACS Auditor application Nov 2004 IHE value growing, looked at ATNA Used this platform for a poster presentation at SCAR/SIIM 2005 that was later published in the JDI Found data useful for QC as well What else can we do with this?

6. Time Line 11/04 Created first iteration of Audit Log app 4/05 SCAR/SIIM GE/Eric Feingold talk 7/06 Offered PACS Audit Log app as open source to GE User Community (SupportCentral) 11/07 Added workflow analysis

7. Talk Objectives Objective 1: Understand how to get Centricity audit log files and what is in them � Objective 2: Understand ways to access and manipulate the data � Objective 3: Understand how to utilize this data to support HIPAA requirements and QC efforts�

8. Term Definitions Database Audit Log XML file Elements/Attributes Events ENM Table MS Visual Basic .NET MS Visual Studio MS Access MS SQL Server/SSE Oracle, Sybase Database as big box with cool tools for extracting (mining) the data Audit log is file in which capture audit events (Windows OS log, db logs etc.) XML file is smaller box of data that we will throw in the big box Events are primary drivers for the record (element and attributes) to be created, EV, EM etc.Database as big box with cool tools for extracting (mining) the data Audit log is file in which capture audit events (Windows OS log, db logs etc.) XML file is smaller box of data that we will throw in the big box Events are primary drivers for the record (element and attributes) to be created, EV, EM etc.

9. Why Care About Audit Data? To satisfy HIPAA requirements Who looked at what To support QC projects Who verified/dictated that exam?! Who rejected those images? How long does it take to verify an exam?! To Monitor DICOM events (not implemented) Who created/changed KIN, ED, PGI To support ILM (Information LifeCycle Management) (not yet implemented) Who created/implemented/changed rules What exams were deleted/moved

10. Hugged Your Audit Data Today? Audit data has a lot of value today As more information is added to it, more value will be derived tomorrow

11. Level I: The Basics GE documents on audit data, events and fields (documentation folder) What does this show us How can we utilize the data (xml, spreadsheets, db) Only look at original here, do 3.x after that slide belowOnly look at original here, do 3.x after that slide below

12. Centricity 2.0 Centricity RA1000, some Exam Manager events logged Start with initial set of audit data Order event is not included Must set 4 of the events in CA Tool LogIn/Out, Exam Print, Exam View

13. Centricity 2.1.x Started capturing events from Centricity Web connections also Added additional events in 2.1.3 that must be set in the CA Tool User\ Created, LoginFailure, RoleChanged, StatusChanged, PasswordChanged, ExamPresentationSaved, ReportViewed Some quirks where didn�t complete the XML file Order event not included

14. Centricity 3.0 Added additional data events/elements that must be set in CA Tool Order event now included giving the complete picture Important shift in architecture to a DICOM view in v3.x This allows us to start capturing data regarding DICOM events Take a look at the events Go over 3.x audit information fileGo over 3.x audit information file

15. Basics Note that in Exam Manager, EM and PM events are logged, as well as status changes (such as verify, unverify etc.), but no event if change patient name or MR directly. Also note that my app now includes the 2.x/3.x events and data fields.

16. Audit Files XML files File structure How do you get them? (your FE) Be aware that the ENM table only holds a set number of days of data, it is NOT a permanent repository That is why they give it to you Also be aware that the event data is 2 days behind Show audit file, discuss basic structuresShow audit file, discuss basic structures

18. Level I Summary Basic terms PACS Audit Events/data from ENM Getting the audit log files from GE Discussed version differences Looked at XML file

19. Level II: Tools Have basic understanding of the audit data Multiple ways to access the data Multiple tools to access the data PACS Auditor tool on SupportCentral site Go over download and file structure it createsGo over download and file structure it creates

20. Installing the Audit Logger Documentation (go ahead, read it�) Need to have .NET 2.0 installed File location structure Issue with fixed db locations Fix using UDL files Need to change driver for Access 2007 Just need to re-link tables in Access fe Describe front end/back end If change location of back end must update UDL and front end table linksDescribe front end/back end If change location of back end must update UDL and front end table links

21. Auditor Trivia Game! Frontend/Backend database Access allows a file size of about 2 Gb This holds approximately 2.9 million audit records (currently on my 3rd) You can create front ends that limit access You can implement some reasonable security

22. Your �PAL� Loading files Safeguards Troubleshooting

24. The �PACS Auditor� Database Basic front end (GUI) for immediate queries Search fields How the date fields work Report buttons Exam 2020, Patients 1228, 2003

27. Level III: Workflow Have basic reporting capabilities that can help address HIPAA requirements Can answer basic questions about who did what using discrete event data Take the data and extract more information from it by looking at time spans between events

28. Workflow Reports Going past event data to look at workflow Time Reports Issues with data Start and end dates can caused partial spans Accession range more complete Skipped status levels (Arrived-Dictated etc.) Manual manipulations (Unverify, Verify) How these affect counts Start with general week report to show detail Then use Start in Period to show change at start Then show Last Page, Summary reports Then show Limit/Max Then use modality selectors etc. Then show Periodic Discuss counts when go from O-D, set OA to this time, sets AD to 0, counts both events even though one did not �happen�Start with general week report to show detail Then use Start in Period to show change at start Then show Last Page, Summary reports Then show Limit/Max Then use modality selectors etc. Then show Periodic Discuss counts when go from O-D, set OA to this time, sets AD to 0, counts both events even though one did not �happen�

30. Update for 2.x/3.x Data Completed the update to include 2.x/3.x data fields Requires a database conversion Will need to load prior archived db�s into a new empty database New db won�t hold entire old �full� db Created routine to help import, but IMPORTANT to follow the documentation

31. Future Work Create new reports/views based on 2.x/3.x data fields Login Failures Image rejects Any other suggestions? Move from Access to SQL Express/SQL Server Build in creation of summary data for use with pivot tables Create de-identified data sets for research use

32. Summary Centricity PACS audit data Satisfying HIPAA requirements Satisfying basic QC needs Using the Time Reports to satisfy advanced QC needs

33. We Can Maximize the Power of Centricity PACS Audit Data

34. Where is it? Both the documentation and the application can be downloaded from GE�s SupportCentral site or our Radiology site Everything we talked about today is in the documentation You get it all as an open source app, but it can be used �out of the box�. No logo�s in it, you can put in your own!

35. Protected Healthcare Information Have proper policies and procedures set up for access to this data Limit user access where you can with specific front end forms

36. Contact Information Do have a day job, there is documentation bgregg@lsuhsc.edu http://www.shreveportradiology.com/department/pacs/downloads (look at end of list) Also have a forum on the GE SupportCentral site See if can get to SupportCentral siteSee if can get to SupportCentral site

37. Thank you for joining this presentation today. Any Questions?