PalmCIS: A Wireless Handheld Application for Satisfying Clinician Information Needs

Background

Medical Errors

The Institute of Medicine's (IOM) report To Err Is Human prompted a plethora of studies on medical errors.1 Several of these studies, as well as preliminary studies performed at NYPH, arrived at similar conclusions: inadequate access to information and ineffective communication among patient care team members are potential proximal causes of medical errors.2 3 4 5 Surveys, focus groups, and observational studies were used at NYPH to assess the perceived information needs and communication difficulties among inpatient physicians and nurses. Survey and focus group responses indicated that a majority of the information needs were related to patient-specific data such as list of medications, problems lists, and laboratory and other test results.3 Reasons for difficulty in obtaining such information included difficulty in finding information, finding inaccurate or outdated information, and limited time. Observations of “teaching rounds” and “walking rounds” found that many information needs remained unmet, and we identified the medical record as the most common resource for satisfying the majority of needs pertaining to the patient.5

Studies of medical errors have not only identified types and causes of such errors but have also proposed possible solutions for reducing them. Information technology solutions can be used to satisfy clinician information needs, but their usefulness and effectiveness must be ensured. There have been several studies reporting the use of wireless and handheld technology to improve data access and reduce delays.8 13 14

Wireless Handheld Technology

The use of wireless technology and handheld devices in all domains has increased dramatically in recent years. Wireless handheld applications offer portability and mobile access to needed information. The wireless handheld environment is ideal for quick lookups, entry of information, and communication on the go.6 However, features such as processing power, memory, display size, bandwidth, and input mechanisms are limited.

In a review of handheld computing in medicine, Fischer et al.7 identified the use of handheld devices to access medical literature and electronic pharmacopoeias; for patient tracking; for medical education, research, and e-prescribing; and for specialty-specific uses. Most of the applications in these categories either involved a one-time installation of information onto the device or obtained new information or updates through synchronization. Few were capable of real-time access to information via wireless communication.

The number of handheld applications that provide access to patient data is growing.8 9 10 11 12 13 14 15 The two major approaches that are used are download-on-demand (DoD), in which data are obtained in real-time using wireless connectivity, or downloading data periodically via the synchronization process.8

The synchronization process is used for the Palm Medical Electronic Record (PalMER) system at the University of South Carolina8 as well as by personal digital assistant (PDA)-based systems at Duke University Medical Center9 and at the University of Washington's Neonatal Intensive Care Unit (NICU).10 11

Other institutions have chosen to use wireless communication rather than synchronization for accessing patient-specific information. Cedars-Sinai Medical Center (CSMC) has implemented a PDA-based application for secure remote access to the clinical data repository over a wireless network called Palm Viewing System (Palm/VS).12 Palm VII devices along with Palm.Net wireless service are used. Cedars-Sinai has also developed an alerting system that delivers alerts and reminders via alphanumeric pagers.13

A real-time notification system has been implemented at Brigham and Women's Hospital.14 To address the issue of delay between the time laboratory data become available and when physicians review them, physicians can request the system to send results via an alphanumeric pager the moment they become available.

Using PDAs to provide real-time access to patient information can alleviate difficulties faced by clinicians. Compared with alphanumeric pagers, PDAs offer more functionality, larger screen sizes, and better input mechanisms. With the sync-based approach, users are limited to accessing only the information that has been downloaded. The DoD approach resolves this issue by allowing access to information anytime, anywhere; however, this approach introduces new security challenges and wireless limitations. While Palm.Net can be used for DoD, it does not achieve end-to-end security, because it uses a proxy server that decrypts and re-encrypts the data that pass through it.

WebCIS

WebCIS is the Web-based clinical information system at NYPH that enables clinicians to browse the content of their patients' medical records.16 17 Each day, approximately 2,000 users access the system to view about 7,000 patient records. These users include attending physicians, housestaff, nurses, students, and administrative staff. WebCIS is accessible through Web browsers running on computers at nursing stations and offices at NYPH as well as from off-campus locations.

WebCIS is implemented as a set of Common Gateway Interface (CGI) programs written in C, which generate Hypertext Markup Language (HTML) and Javascript. WebCIS displays information from ancillary, registration, and ambulatory systems. Users can retrieve information sorted by department and then time, sorted purely by time, or aggregated in one of several views, including spreadsheets, cross patient summaries, and graphs. HTML frames, tables, and links are used primarily to display and access information. Pop-up windows are often used for certain functions or to display supplementary information (Fig. 1).

WebCIS interacts with several existing systems at NYPH including the Clinical Data Repository (CDR), Medical Entities Dictionary (MED), and Lightweight Directory Access Protocol (LDAP) server. It retrieves patient data via Data Access Modules (DAMs) from the CDR, which is a centralized repository that collects data from all clinically relevant applications in our institution. Because some of the data in the CDR are in coded form, the Medical Entities Dictionary (MED) is needed to translate these codes into meaningful names. The MED is a controlled terminology of concepts organized in a semantic network.18 Each concept has a unique MED code and frame-based representation that includes information about its name, synonyms, ancillary system codes, classification, and relation to other concepts. The LDAP server contains information about all WebCIS users such as name, telephone numbers, and title. This server is used for authentication purposes because it also stores usernames and passwords for all WebCIS users.

Design Objectives

The motivation behind PalmCIS is to satisfy clinician information needs by providing needed patient information anytime, anywhere. Studies have indicated that lack of access to or availability of patient information is one of the causes of medical errors. PalmCIS is being developed to serve as a wireless handheld extension to WebCIS. PalmCIS will enable WebCIS users to view their patients' data when they may need immediate access such as while on walking rounds, while on teaching rounds, or traveling.

Two major concerns for design and development of PalmCIS were end-to-end security and usability. The system must adhere to the highest standards of security and be HIPAA (Health Insurance Portability and Accountability Act) compliant. In designing the user interface, the screen should display as much as possible while allowing the data to be easy to navigate and read. The information presented should also be needed by, and useful to, the user at that given time.

According to HIPAA, exchange of electronic health data must adhere to its standards for security and confidentiality.19 Therefore, at every step, PalmCIS needs to meet these security standards. Our solution should include, at minimum, direct, end-to-end encryption of data; authentication; authorization; session management; and maintenance of audit logs.

One of the key factors to the success of a patient record system is the human–computer interface.20 However, the user interface is often one of the major challenges confronting developers. Lack of good user interfaces has been a major impediment to the acceptance and routine use of health care professional workstations.21 Therefore, there are two goals for the PalmCIS user interface: to present relevant information when it is desired and to present information in an organized way that keeps in mind the limitations of the wireless handheld environment such as screen size and bandwidth.

System Description

PalmCIS is platform independent and is based on client–server architecture (Fig. 2). On the client-side, wireless handheld devices run their respective browsers, which interact with the user to display the requested information. Applications on the secure server are responsible for retrieving this requested information and formatting it for display. To allow the clients and server to communicate, PalmCIS uses a wireless wide area network (WWAN).

Client-side Development

We first did a survey of the hardware and software options available for wireless handheld applications. We needed to choose the client device, client application, and wireless communication service. Once these were selected, we then could begin development of the server applications. Because certain client devices can operate only with particular wireless communication services, these needed to be evaluated together.

There are several types of wireless connectivity that can be used depending on the range of communication desired. Infrared, Bluetooth, and the IEEE 802.11 family of specifications offer short-range or local area communication. Mobile telephony and data standards such as CDPD, CDMA, and GSM allow for long-range or wide area communication. The category of handheld devices includes mobile phones, pagers, and personal digital assistants (PDAs). Mobile phones and pagers are intrinsically capable of wireless communication; however, PDAs may require additional hardware to communicate wirelessly. We chose to use a wireless wide-area network (WWAN) to provide wireless communication for PDAs.

Our interest was in Palm OS devices, as they serve our purposes, and there is an enormous amount of software available for this operating system. PDA phones such as the Kyocera QCP 6035 offer all-in-one solutions by being a combination of a PDA and cellular phone. Using wireless communication services, they can provide users with real-time mobile access to information. To provide such information, a client application is needed. Web Clipping Applications (WCAs) are a popular way to retrieve information wirelessly. Because these applications use the Palm.Net proxy server that decrypts and re-encrypts the data that pass through it, we do not consider them to be secure solutions. There are many Palm OS browsers available, such as AvantGo and Blazer; however, few offer direct, end-to-end Secure Socket Layer (SSL) encryption. EudoraWeb is one of the few that does, and it meets all our security criteria. This browser has some limitations, however; it can only handle a subset of HTML and does not support popular Web technology such as Javascript. After careful evaluation of the solutions available at the time, we chose to use the Kyocera QCP 6035, SprintPCS wireless communication service, and the EudoraWeb browser.

Since we decided to pursue a platform-independent solution, PalmCIS can not only be used on the Kyocera QCP 6035 but also on other handheld devices as well as laptops and desktops running other operating systems such as PocketPC, Linux, MacOS, and Windows 9x/2000/XP. Browsers that offer direct SSL encryption, such as Netscape Communicator and Internet Explorer, can be used on these devices.

Server-side Development

The PalmCIS server application is responsible for performing a number of security measures, retrieving data from the clinical data repository, translating the data, and formatting them for display. Before development of the server programs, we set up an Apache Web server and installed a Thawte SSL certificate to complete the server-side end-to-end SSL encryption.

We want to provide comparable functionality to WebCIS, but since EudoraWeb is limited to a subset of HTML and does not support Javascript, we developed an application that keeps all the limitations in the background while presenting information that is deemed appropriate and useful. Like WebCIS, PalmCIS interacts with the CDR, MED, and LDAP server. The server application is implemented in C and uses CGI and a subset of HTML.

PalmCIS Functionality

PalmCIS seeks to provide users with a concise view of their patients through presentation of a patient report, which contains a summary of results for the last two days. If necessary, users can obtain details for the results as well as access previous results. Our system consists of five major steps to accessing needed patient information: sign-on/login, patient list, patient report, result details, and previous results.

Sign-on/Login

Every user is assigned a static HTML page that serves as his or her sign-on page (Fig. 3a). This page contains the user's unique user ID. When the user signs on, several security checks are performed including user and IP address authorization. The IP address is assigned dynamically by SprintPCS each time the user signs on. The user ID and IP address are checked against our list of authorized users and list of authorized IP addresses, respectively. This user and IP address authorization is performed at every step of PalmCIS.

Once signed on, users are presented with the login page to authenticate themselves. Strong or two-factor user authentication refers to providing “something you know as well as something you have.” For WebCIS, users logging into the system from off-campus locations are required to pass strong authentication by using their RSA SecurID hardware token in addition to their user ID and password (Fig. 3b). The RSA SecurID system is the world's leading two-factor user authentication solution and uses an authenticator, which generates a new, unpredictable token every 60 seconds.22 WebCIS users use this 6-digit SecurID token along with their password to log into protected resources such as WebCIS. Because SprintPCS assigns IP addresses that are considered off campus, we had considered doing the same for PalmCIS. However, requiring users to enter their password and SecurID for every login on a handheld device seemed tedious and would require them to carry around an additional piece of hardware at all times.

We devised a scheme in which strong authentication could be obtained using the user ID, password, browser cookie, and SecurID token every seven days (Fig. 4). Cookies are messages that are given to a browser by a Web server.23 These messages are saved by the browser and can be used in future requests to identify users and possibly prepare customized Web pages for them. With this scheme, PalmCIS users only need to provide the SecurID token every seven days. Each time the token is entered, a seven-day cookie (randomly generated number) is placed on the device's browser and stored on our server in a user-specific file. Depending on the cookie, users will be either prompted for both their password and SecurID token (Fig. 3c) or password only (Fig. 3d). Since the sign-on/login step is two phased, we create a sign-on identifier so that users cannot reuse the login page and must return to the sign-on page.

Once the user is authenticated, a random session identifier is generated that is passed and checked on each successive page. This session ID lasts for 15 minutes and is stored on our server in a user-specific file. The session ID not only serves to authenticate the user but also to reduce tailgating, in which a person uses someone else's account after he fails to log off. If a session ID expires or becomes invalid, users are required to re-authenticate using their password (and possibly SecurID token depending on the cookie).

Two other important security measures we take are maintenance of an audit log and e-mails notifying of successful or unsuccessful login. Every action the user performs is recorded in the log. Both these measures allow us to determine if inappropriate activity is occurring. Additionally, the audit log allows us to monitor system usage, which can assist us in making appropriate system improvements.

Patient List

Upon successful login, users are presented with their patient list (Fig. 5). WebCIS provides primary and secondary patient lists for each user. Users' primary lists typically contain inpatients, while the secondary list contains outpatients. Users can add and remove patients from these lists, which then are stored in the clinical data repository. For PalmCIS, we only display the primary list in a pull-down menu. The location, medical record number (MRN), and name of each patient are contained in this menu. Users also have the option to specify an MRN if the patient they are interested in is not in the patient list.

Patient Report

Once a patient has been selected, the patient's report is displayed (Fig. 6). The content of the report was defined by a hospitalist we consulted with at NYPH as well as physician members of our development team. The patient report summarizes the patient's laboratory, cardiology, and radiology results for the current and previous days. Within each department, the results are categorized. Laboratory results are classified as “Chem7,” “CBC,” “Hepatic,” “Coag,” “Microbiology,” and “Other.” Radiology results are divided into “CXR” and “Other.” Cardiology results are categorized as “Echo,” “EKG/ECG,” and “Other.”

The report only provides a summary of each departmental result, not all the details. It presents the timestamp, complete name of the result, and more essential information in a pull-down menu. For most of the laboratory results, it displays the values for the components of the result. For example, it displays the values for sodium, potassium, bicarbonate, chloride, blood urea nitrogen, creatinine, glucose, and calcium delimited by “|” for Chem7 results. Microbiology results differ slightly in that information like “specimen” and “culture” are displayed as text outside the pull-down menu. Similarly, more essential information is displayed as separate text for radiology and cardiology results. We include a link to a page defining the different result formats for the users' reference.

Result Details

As mentioned, the patient report only contains a summary of results. Users do have the option of viewing all the available information for these results. Next to the pull-down menu for each result is a submit button containing a “+.” This button indicates that more details can be viewed for the respective result. The result details page displays the name, timestamp, and all related and relevant information for the result (Fig. 7).

Previous Results

In addition to the results presented in the patient report, users can view departmental results prior to the previous day as well as pharmacy reports, sign-out notes, and discharge summaries (Fig. 8). At the bottom of the patient report is a checklist containing a list of departments. The laboratory option also has a pull-down menu in which the user can specify the category of laboratory results to view. Once users select the department(s) they are interested in, the most recent results are displayed. Unlike the patient report, only the timestamp and name are displayed in the pull-down menu. Again, the user can access result details via the “+” submit button. For each department, five results are displayed at a time. The user can continue to retrieve previous results until none is left using the “Get previous!” button. Users can quickly return to the checklist to choose other departments using the “Back to checklist” button.

Infobuttons

PalmCIS currently has an additional feature aside from providing access to patient data. Through a search mechanism and infobuttons, it provides users with access to medical knowledge. A search function has been integrated that allows users to query PubMed, a search and retrieval system that provides access to citations from biomedical literature.24 The user inputs a search term, and relevant article abstracts and citations are returned (Fig. 9).

Infobuttons allow users to receive answers to patient data-driven queries from outside health information sources.25 The current system has a microbiology infobutton that allows the user to view results from PubMed and Micromedex about microbiology result organisms and antibiotics, respectively (Fig. 10).

Status Report

The Kyocera QCP 6035, SprintPCS, and EudoraWeb provided the base for PalmCIS. Together, these solutions provide direct, SSL encryption, our initial key security criterion. We built upon this security measure by adding user and IP address authorization, strong user authentication, sign-on management, session management, audit logs, and login notification. We considered the limiting features of PDAs such as screen size and input mechanism, the limitations of EudoraWeb, and the limited bandwidth provided by SprintPCS when designing the PalmCIS user interface. We sought to minimize the amount of scrolling and number of client–server interactions. Pull-down menus are central to the PalmCIS user interface; they are space saving and can provide much information when expanded. The patient report seeks to provide users with anticipated patient information, thereby reducing the frequency of data retrievals.

PalmCIS was deployed in August 2002. We have distributed 10 Kyocera devices among 15 users (housestaff and hospitalists) since that time. One of the devices is rotated among four chief residents, and two devices have been passed from one user to another. All other devices have remained with their original owners.

After an initial demonstration of the system, 12 users have continued to use it. We performed an analysis of the PalmCIS audit log to understand how the system is being used. The system is used at all times of the day and usage ranges from once a month or less to several times per month. On average, there are 14 user sessions per month. Users view results for one to nine patients per session. Aside from viewing the patient list and patient report, the more frequently used PalmCIS functions include viewing of laboratory results (50%), viewing previous laboratory results (14%), viewing consult or sign-out note details (6%), and viewing microbiology result details (6%).

We designed a two-part survey containing 30 questions to gather information regarding the usability of PalmCIS. The first part of the survey contained general information questions about the user's experience with WebCIS, the Kyocera QCP 6035, and PalmCIS. The second part asked more detailed questions about the user interface and functionality of PalmCIS.

We surveyed five users who, according to the audit log, had used PalmCIS at least once. These users stated that they used the system at home, at work, and while traveling. Each of the users felt the information in PalmCIS was appropriate and was satisfied with the information. The one major issue that was commented on was the speed of the system. All the users felt the system was too slow and that faster connection and retrieval times would lead to an increase in use. Many stated that since desktops are available to them with access to WebCIS, they would be more inclined to use that. When asked for comments on the five PalmCIS functions (sign-on/login, patient list, patient report, result details, and previous results), users generally responded positively and had several suggestions for enhancements. Related to the speed issue, several of the users felt that the sign-on/login feature was cumbersome and slow. There were requests for features currently found in WebCIS, such as secondary patient lists, nursing station lists, and laboratory summaries. One user commented on how it takes one step to reach certain results while it takes two to retrieve others and suggested reducing the steps for faster and easier retrieval. Another user suggested modifying the layout to be similar to WebCIS so that it is more user friendly and legible. With regard to health resources, users stated that they would also like to have links from PalmCIS to UpToDate, Ovid, and Google.

Other extensions that are being integrated into both WebCIS and PalmCIS are the Virtual Whiteboard, team scheduler, and event monitor. The Virtual Whiteboard is used for posting, routing, and tracking communications among nurses and physicians on the same health care team.26 It is intended to limit the number of paging interruptions by providing a mechanism for sending simple messages to other providers asynchronously. Because of difficulty in identifying the members of a health care team, we have developed a Web-based team scheduler to maintain intern schedules and assign roles for team members.27 Event monitoring and alerting are fully implemented in WebCIS; however, they are still under implementation in PalmCIS.28

PalmCIS provides only a subset of patient information that can be found in WebCIS. We are currently using automated methods that involve analyzing WebCIS logs to identify what data are commonly viewed in WebCIS and how users access those data. The results of this study can inform us about the data to include in PalmCIS and how to organize them within this system.

Discussion

Wireless handheld technology is constantly evolving and improving. The solutions we chose were the few that fit our criteria at the time. Now, there are more advanced handheld devices, wireless services, and browsers available. While PalmCIS has proven to be a functional system, usage has been limited. Fortunately, new options can significantly improve the capabilities and performance of our system.

One unanimous remark from the surveyed users concerned the issue of speed. The sign-on/login function was considered onerous. The connection and retrieval times (15 seconds on average) discouraged more frequent use of PalmCIS. We are currently using 2G SprintPCS service to provide PalmCIS with communication over a WWAN. Compared with wireless local-area networks (WLANs), this service provides only a fraction of the bandwidth. Additionally, there is a significant connection establishment time in addition to the round trip time for transactions. Newer WWAN technology such as GPRS and 3G may provide significant improvement in throughput and latency as well as eliminate connection establishment times. Another option is to use a PDA that can operate on both a WLAN and WWAN. Therefore, users could get high throughput in a local area and mobile access outside of it. Symbol, Casio, and Fujitsu-Siemans have developed PDAs capable of both WLAN and WWAN communication. Devices that are WWAN capable can be enhanced through use of Compact Flash (CF) or Secure Digital Input Output (SDIO) expansion cards to provide both modes of wireless communication. PDAs that offer WLAN communication can be connected to cellular phones using Bluetooth or special cables to become WWAN capable.

The Kyocera QCP 6035 runs Palm OS 3.5.1 and has a monochrome screen. Newer devices that run more current Palm OS versions and offer color screens are more attractive in terms of functionality and appearance. The EudoraWeb browser can handle only a subset of HTML and does not support images or Javascript. This limits our options for the layout and formatting of PalmCIS. Several new browsers have emerged that support SSL, HTML, Javascript, and images. Browsers with such features combined with newer devices can allow us to design a more robust and user-friendly application. The PalmSource Browser 2.0 for Palm OS 5 is a new proxyless browser that supports many standard Internet technologies, including HTML 4.01, Javascript 1.5, and SSL 3.0.29 Other browsers include EIS Web for the Kyocera 7135 and Anygraaf Doris Browser for SymbianOS devices.

Like other institutions, we have considered implementing a feature that allows one-time retrieval of patients' data. For example, users would be able to download reports for several patients at the start of each day. Instead of having to deal with connection times and low throughput throughout the day, users would already have the information at hand. If additional information is needed, users could then access it in real-time. We currently are unable to download large amounts of data because of EudoraWeb's size restrictions. However, newer browsers could make it possible, and we can also use different types of wireless connectivity for faster downloads.

One nice feature of Palm VII devices is that each device has a unique device identifier. Through Web clipping applications, this device ID can be obtained and used for strong user authentication. With this scheme, no additional hardware is needed. RSA SecurID is central to our particular security setup. Although we only require users to enter their SecurID token every seven days, this still requires them to carry around another piece of hardware in addition to their handheld device. RSA software tokens provide a solution to this issue. They offer the same functionality as the RSA SecurID hardware tokens; however, they can reside on a desktop, laptop, or PDA.

We can provide another level of security by protecting the client device on which our application runs. Most PDAs come with a locking feature that, when activated, requires users to input a password before allowing them to use the device. There are other locking and encrypting programs that can be installed, such as TealLock and MovianCrypt. PDAs with biometric security are emerging such as the HP iPAQ 5450 and 5455, which feature a biometric fingerprint recognizer.

PalmCIS is currently purely a data retrieval system. It provides access to laboratory, radiology, cardiology, and pharmacy results as well as sign-out notes and discharge summaries. Users can also retrieve articles from PubMed and obtain information from Micromedex. We are now moving toward data entry through addition of a function to quickly create and update sign-out notes.

Conclusions

Wireless handheld clinical applications have the potential to alleviate the problem of inadequate access to clinical information. PalmCIS is a wireless handheld extension to our Web-based clinical information system that provides direct access to the clinical data repository.

Our goal in the development of PalmCIS is to provide information to clinicians when they need it. It is not simply a matter of making data accessible, but making relevant data available in an optimal way. From our audit log analysis, we know that the system is being used and which functions are more popular. Results from our survey indicate that our system is useful. The one major concern and limitation was speed, which can be remedied by newer wireless handheld technology. In general, users reacted positively to the features and information available. The suggestions and comments provided by surveyed users along with results from our WebCIS log analysis can be used to inform us about what additional information to include and how to organize both current and new information. With this knowledge, we can enhance our system and make it available to a wider audience. Overall, current PalmCIS users are satisfied with the information and features found in the system. With newer technology and enhancements, it may prove to be a valuable clinical tool.

Inadequate access to patient information and lack of communication among health care team members have been identified as causes of medical errors in a number of studies. Information technology can be used to alleviate these problems by providing access to desired information when it is needed. We are exploring the use of wireless handheld technology as a new way for facilitating everyday clinical tasks. We have successfully developed wireless handheld solutions to provide access to patient data and medical knowledge resources as well as to facilitate clinician communication. Our next step is to identify the impact of this technology and these solutions on the health care process.

The wireless handheld environment presents new challenges for producing effective applications due to its unique limitations. We have taken into consideration these limitations when designing the user interface and thinking about system functionality for PalmCIS. We have developed a secure, usable, platform-independent application that provides access to patient data via a wireless PDA.