12 ms·
PatientBank (YC S16) Is Creating a Unified Medical Record System
- pfletcherhill 10y agoHi all—this is Paul, I'm a co-founder at PatientBank. We gather medical records online. Feel free to send any questions, comments, or feedback my way. My co-founders and I will be around ready to answer!
- throwanem 10y agoHow do you handle authentication and authorization? Suppose I have a nefarious enemy who attempts to use your service to obtain my medical records so he can poison me or embarrass me or something. How does he fail?
- pfletcherhill 10y agoWe make it really easy to request medical records, but we also verify requesters' identity before allowing them to view medical records we collect. We actually use an awesome YC company called BlockScore to handle a lot of that (https://blockscore.com/ https://blockscore.com/)!
- mertcelebi 10y agoIn addition to identity verification, there are two more things we do to protect the privacy of our patients! 1) If the electronic signature on a given request doesn't match the name of the patient, we make sure that the patients are who they say they are before moving on with gathering the medical records. 2) If one tries to sign up on behalf of another patient, we require a Power of Attorney (POA) document! Hope this answers your question!
- kaybe 10y ago1) What are you using to create the signature? How can you guarantee that the attacker can't create the matching signature? 2) How do you know they're trying to do that if they don't tell you? Your scenario looks like a regular situation, not an attack..
- jrowley 10y agoI love how y'all seem to be using lots of other YC companies to get the job done. Seems like a great service you provide!
- pfletcherhill 10y agoAbsolutely! YC has been a huge help. Thanks for the feedback!
- kaybe 10y agoI wasn't really able to get the details on that page, but it seems like they do verification by checking personal information like name, birthday and address against a database and ask a few multiple choice questions related to them. How is that not easy to circumvent if the attacker has that set of information? (can probably be obtained by a social attack on the victims bank) I'm assuming there's something I missed there.
- throwanem 10y agoI don't think there is. Knowledge-based authentication is extremely vulnerable to identity theft.
- aestetix 10y ago"BlockScore complies with the US-EU Safe Harbor Framework and US-Swiss Safe Harbor Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries and Switzerland" This Safe Harbor Framework?: https://techcrunch.com/2015/10/06/europes-top-court-strikes-down-safe-harbor-data-transfer-agreement-with-u-s/ https://techcrunch.com/2015/10/06/europes-top-court-strikes-...
- shigawire 10y agoHow does this integrate with popular EHRs? Most support this type of record sharing between each other and ways to share those records with the patient themselves.
- pfletcherhill 10y agoWe certainly plan to integrate more directly with EMRs in the future, but at the moment we just go through hospitals' medical records departments. We have 5-6 different ways hospitals can respond to our requests. What we've optimized for is simplicity—while our process for getting medical records from hospital A may var from our process with hospital B, we abstract all of that away and make the ordering process the same for all U.S. hospitals.
- mbesto 10y agoThat is a massive undertaking...good luck.
- mertcelebi 10y agoThanks mbesto - we appreciate your support :)
- simonebrunozzi 10y agoWhat's your business model? I think this should be clear from the start.
- pfletcherhill 10y agoGood question! We charge a flat fee for each medical record we gather. So whoever is requesting the record pays for it. We can certainly work on making that clearer up front though—thanks for the feedback!
- Vekz 10y agoI love this idea. I have been kicking it around myself. Glad to see caliber of team and execution on it. How much of a schlep is this currently? How automated is the product? Are you cold calling medical offices behind the scenes to collect on behalf of your users?
- pfletcherhill 10y agoAwesome—excited to hear it! We have 5-6 different ways hospitals can respond to PatientBank orders for medical records right now. These range from fax or even snail mail to automated integrations—we do whatever it takes to help the hospitals comply. For the first few orders, some hospitals are slow to respond or skeptical, but we start seeing a significant behavior shift after 10-20 orders. You can check out hospitals' performance stats here: https://www.patientbank.us/stats/about https://www.patientbank.us/stats/about.
- randycupertino 10y agoHsve you tried getting any records from the VA yet?
- killerbat00 10y agoIt appears that PatientBank acts as a decentralized medical records/Release of Information office that may communicate with a number of physicians and hospitals. I'm curious though, how are you collecting the medical records? Are these interfaced directly from EHRs, or some other method? Do you handle releasing to 3rd parties (legal, etc); the article seems to hint that it's directly to patients and immediate family. Lastly, when a patient has shared their records with a new physician via PatientBank, is there any functionality for exporting these records into the physician's organization's EHR? Or will relevant data need to be manually copied into the new chart?
- pfletcherhill 10y agoGreat questions! So while the way a user orders medical records on PatientBank is the same across all U.S. hospitals, we have 5-6 different ways hospitals can fulfill those orders. These vary from fax or even snail mail to integrations. We actually opened up a lot of our performance data from hospitals here, if you're interested: https://www.patientbank.us/stats/about https://www.patientbank.us/stats/about!
- mertcelebi 10y agoAbout exporting the data we gather to a new PHR and integrating the new information to patient's existing chart: There seems to be a couple options! 1) Once we gather your records, we will work on creating a shareable summary of your health history. In that case, the physician can look at that summary via our web portal. 2) In many cases, most EHRs support the upload of PDFs. So, the documents you share can be "integrated" to hospital's EHR. This already happens in large hospital networks when hospitals gather medical records on behalf of patients before their appointments! When hospitals receive the records via fax or mail, they scan the pages to the EHR. Obviously, in the future, easier ways to export data (via EHR integrations) could be extremely valuable to patients and physicians!
- nradov 10y agoIn general most providers are never going to read through a bunch of scanned pages exported from another provider's chart. They just don't have enough time.
- NearAP 10y agoAre you worried about the consolidation going on among hospitals i.e the fact that it seems like hospitals are becoming part of a group and thus end up having unified medical record systems? For example, Palo Alto Medical Foundation has hospitals spread across the Bay Area. Some of the hospitals don't offer all the services but if you walk into a new branch for a specialized treatment, your new doctor will simply look up your old record or order it internally if they are not yet on the network.
- kmgrassi 10y agoGreat point. We are seeing ongoing consolidation among hospitals and large physician groups. However, patients still deserve to have easy access to their own data. This is largely handled with patient portals that give patients access to some of your data. PatientBank gives you full control of your complete record, including information not necessarily located in your patient portals and information located in separate systems that do not communicate.
- tkiley 10y agoHi Paul. I'd love to see your service take off. I've spent a few years in healthcare IT and think that the world would be a better place if you succeed. With that said, there are a number of startups that have struggled with similar ideas. How are you different from, say, PicnicHealth?
- pfletcherhill 10y agoThanks for the kind words, tkiley! There are a number of great products out there to help people manage their medical data. But that's a big problem to tackle, and we're focused on one small piece of it—requesting medical records. In fact, our market often differs from folks who use a personal health record. Many of our users have been asked by their doctor, their insurance company, or a lawyer to gather and share their medical records and they just want help with that process.
- seagreen 10y agoCan you tell us some about the technology you're using? I'm curious if a newfangled immutable database like datomic would be a good fit for medical recods. Also, do you do any schema'ing besides what's provided by your database (JSON Schema/XML Schema/etc)?
- gkaemmer 10y agoOur data is primarily stored in postgres. We've looked into using Mongo to store FHIR-compliant documents, which is the newest standard (and best standard, IMO) proposed by HL7. Haven't looked at that many immutable databases, but they seem interesting. Most of the time medical data does not require many writes (rarely are two doctors editing your record simultaneously), but the audit trail that datomic provides could be very useful as a built-in feature.
- ams6110 10y agoQuestion for any MDs on here: How often are old medical records helpful and studied? Every time I go to a new doctor the first thing is a medical history interview. They are rarely interested in records from any other provider, in fact I've never been asked to help facilitate that. But I'm not sure how typical my experience is.
- FireBeyond 10y agoNot an MD, but an EMS provider. I know that delivering patients to a hospital often results in the nurse or provider taking a history, even when the patient has been seen (recently) in the ED. House's rule number one, patients can't be trusted. You wouldn't believe how often patients give the hospital contradictory information to what they gave me, and on the most "innocuous things", past medical history, allergies, and so forth. So it can be as simple as 'trust but verify', or 'clean slate'.
- kmgrassi 10y agoIt can be hard for patients manage all their health information. That is the problem we are trying to solve! Obviously, this starts with patients having more control over their data. Imagine the next patient you transport pulling up their PatientBank account and it has an up to date medication list, allergies and PMH. Instead of relying on memory they have all their information in one place - when they need it.
- kmgrassi 10y agoHi there - this is Kevin Grassi, MD with the PB team. You are absolutely correct that many primary care doctors rely on the patient to provide a medical history and rarely need the specific information located in the medical record. However, if you have complex medical issues, your primary care doctor may want to see specific data - especially lab or imaging reports. Many specialist doctors need to see previous medical records before evaluating and treating the patient. This is especially true in oncology. We work with the Smilow Cancer Hospital, part of the Yale-New Haven Hospital, to help ensure that all oncology patients present for their first visit with a complete medical record. One final note that is my assessment of how physicians operate in the current system - doctors are accustom to working with incomplete information. PatientBank is striving to make previous medical information more accessible to your next doctor. My hope here is that increased access to information will cause doctors to pay more attention to your data and lead to better care. Thanks for your question! I hope this clarifies things.
- jeremyt 10y agoI actually think that medical records are basically public. It's only a matter of time before the various doctors offices or government agencies or private companies that hold these records are hacked and the records released on the Internet. That said, I would definitely trust a private entity with specialized knowledge over the government or individual doctors offices, so I wish you the best of luck. For example, I just had my medical records sent from an old doctor's office, and the only thing they required was a fax with my signature on it and an address to send the records to. Could have been sent by anybody to anywhere, and there were no checks whatsoever.
- ams6110 10y agoThe difference is that the old manual system is not so prone to mass data breaches. My employer used a service called NoMoreClipBoard. They enrolled everyone enrolled in a health plan, not just those who requested it. When the inevitable data breach happened, everyone was affected not just those who had specifically enrolled for this service. I don't ever want my medical records in any internet-facing system. I realize that's a fantasy but I'd never voluntarily help make that happen. FTA: We use another YC company called Aptible. They’re experts in securing protected health information, and we follow best practices to make sure our servers are safe. It's not just the security of the servers. Many data breaches are the result of careless handling of data (USB flash drives, laptops, email attachments) and social engineering attacks.
- mertcelebi 10y agoHi ams6110 - we also use Aptible! It is definitely true that the old, fax-based system is not so prone to mass data breaches. That is one of the reasons why hospitals still use fax to transfer medical information. But, at PatientBank, security and privacy of our patients are our top priorities. So, we go above and beyond what HIPAA recommends in terms of security best practices. You can read more about that here: https://www.patientbank.us/legal/hipaa https://www.patientbank.us/legal/hipaa
- Pfhreak 10y ago
- deleted 10y ago[deleted]
- shostack 10y agoWhat legal protections are you offering to ensure my patient data is not monetized down the road, directly or in aggregate? How would you protect patient data in the event you sell or go under?
- pfletcherhill 10y agoGreat question! In the case that something happens to PatientBank or we go under, we guarantee that we'll continue to host users' medical data. It's also worth noting that we already make it really easy to export your medical records from PatientBank.
- shostack 10y agoYou dodged the bulk of my question around privacy, data ownership, etc. Is it safe then to assume your business plan is to be cavalier with this data against my authorization and monetize it in a non anonymous fashion?
- mertcelebi 10y agoHi shostack, I am so sorry part of your question was unanswered. As I wrote in a couple other questions, patients' privacy and their data security are our top priority at PatientBank. What that means is, in any product or business decision, patient satisfaction, happiness and their trust in our service are top things we consider. So, we would not share patient data with any third party without patients' explicit consent! Hope this clarifies things!
- mbrameld 10y ago> patients' privacy and their data security are our top priority at PatientBank Is it really your top priority? Things like that always sound so disingenuous to me. Surely your top priority is building a profitable business, no? Otherwise there would be no data to even worry about. When the response to the yes/no question of "Are you going to sell my data?" is "Your privacy is our top priority" instead of "No", run far far away.
- nradov 10y agoTheir records won't be unified in any meaningful sense since when a provider generates new records for a particular patient those won't automatically be pushed to PatientBank. I think in the long run this problem will be more effectively solved by providers exchanging data with each other using IHE integration profiles. It's great to give patient's easier access to their charts, but from a care delivery standpoint routing clinical data from a provider to a patient and then back to another provider is unnecessarily slow and error prone.
- leovander 10y agoBingo. If you search for my previous comments in this thread, you can see my concerns about the general state of IHE's. In one of the comments I mentioned about Blue Button, which allows patient's to pull their data. (To be fair, I haven't really seen the button in too many places out in the wild). I guess ultimately in order to be able to get your charts from where ever you move, all those smaller IHE's need to feed into one repository and then have those scale up from county to county and even statewide. The problem with that of course is how all the partner systems are queried or what profiles that have decided to use. i.e. will a data source being pushing documents to the repository every time there is a new patient or update, or will that network go out and ping every data source for their most up-to-date record. If PatientBank is just dealing with Fax primarily and working with FHIR, I am curious how long they will work with Fax until there is a high adoption rate of FHIR for them to be able to get properly clinical items, that one of their clients could then pull their data and then push their data to their new provider.
- nradov 10y agoI think you might have mixed up HIEs and IHE. With XCPD there's no real need for one central repository. Independent systems can interoperate on a peer-to-peer basis. In the USA a central patient chart repository would be a non-starter anyway for political and business competition reasons.
- jgalt212 10y agoWe didn't hire Josie because she wasn't' a "cultural fit." real reason: due to a previous medical records hack, we found out she had HPV.
- Meegul 10y agoWill you guys be looking for interns next summer? I'm a CS major who's currently finishing up a software engineering internship at a major healthcare company. I'd love to get in touch, if so.
- mertcelebi 10y agoHey Meegul, thanks for your comment! We'd love to chat! You can always reach out to me at mert@patientbank.us or info@patientbank.us!
- Eriselle 10y agoIn what ways does this offering differ from Microsoft's HealthVault? Is it that you do the gathering of health data on behalf of the patient?
- mertcelebi 10y agoGreat question! For Microsoft's HealthVault, patient would have to gather the records themselves AND enter the information into HealthVault manually. We make it super easy for patients to gather their medical information and make it even easier to manage (share with physicians, family members etc.) their information.
- kumarski 10y agoLots of exciting stuff happening in this space! PatientBank is a gamechanger too. Annotating records and storing it for drug discovery is the biological dream. Let's find twins where one has the disease and the other doesn't and slap in the PlaidAPI to see their daily behavior to find potential drug targets. Something big coming up hopefully. ----------------------- EMR Records Aggregation ----------------------- HumanAPI GetMedal BloomAPI UsePrime ZweenaHealth Doctrly Carebox GorillaHealth NuskiHealth PicnicHealth – If you’re developing an application and want to preview what records look like in here, message me. Happy to help you: ----------------- HIPAA Compliance ----------------- There’s a host of SDKs that revolve around spinning up HIPAA compliant applications. They’re each worth looking at. Aptible Catalyze TrueVault ClearData Google & Amazon HIPAA Capabilities/Offerings to Developers There’s even large Fortune 500’s playing in the space of making HIPAA compliant backends more viable for the early stage innovator. Google’s HIPAA Offering Amazon’s HIPAA Offering
- pfletcherhill 10y agoThanks for the comment, kumarski! Excited to see a lot of awesome work being done here.
- kumarski 10y ago<3
- hkiely 10y agoAs someone who's worked in drug discovery and development, I wish finding bio-markers and drugging targets were this easy so we could improve the lives of millions of patients. Patient phenotypic information is locked up in the clinic notes often as free text or is no longer entered very well at all because doctors are rushed seeing more patients. Tools like The human Phenotype ontology format help solve this problem and are being used in translational biomedical informatics. http://human-phenotype-ontology.github.io/downloads.html http://human-phenotype-ontology.github.io/downloads.html
- 10y ago
- leovander 10y agoAt this point, everyone is trying to get the data from the hospitals and present it to the patient. Is there anyone trying to compete with the giants in healthcare to make sure there is clean data to pull from in the first place? I spend day and night manually reading CCD/CCDA's making sure they match the loose specifications that HL7 provides, but there seems to be so many disconnects between one vendor and another. I am curious if your digitization of data is mostly pulling from these CCD documents themselves or actually performing OCR on physical data. Yes, there are also DICOM/PDF/etc that can act as attachments as well. I saw in one of the comments you mentioned about integrating with hospital systems, I am curious to how that might correlate to what access you guys do have and to which patients as well. I am assuming you can piggy back on levels of consent and confidentiality that EMR's already have logic for. Anyway good luck, if you guys are ever looking for remote (US-CA) let me know.
- lbhnact 10y agoIs there anyone trying to compete with the giants in healthcare to make sure there is clean data to pull from in the first place? We are. :) I empathize with your problem with CCD/HL7v2 as much as you can imagine; which is why we support FHIR infrastructure across a number of use-cases. Feel free to reach out, I always enjoy chatting with people experienced in the space.
- gkaemmer 10y agoThanks for the comment, leovander—very good points! Right now we give hospitals a number of ways to respond to PatientBank requests. Currently, the most common one is fax and we don't (yet) perform much processing of that data. In addition to fax, we allow hospitals to send CCD/CCDAs to us via DIRECT, and we allow them to upload arbitrary files directly to PatientBank as well. In the future, we'll use whatever APIs we can to get records from hospitals. There's a lot of promising work going on in this space, and we're excited to see where the industry leads!
- ndonnellan 10y agoClean data is hard, especially with such fragmentation, but there is progress! My company supports CCD/HL7 with as many other vendors as will work with us, but you're right in that the loose specifications make it very hard. I just worked on a project to import 1M+ patient records and we spent a long time verifying that we weren't just getting junk. "This field says it's an ICD-9 code, but I just see a string description..." We also have a restful API that has a lot more traction with startups (honestly because it makes more sense). There is still so much legacy thinking around "documents" that we are more often trying to step back and think "is there a better paradigm we should be pushing here?".
- hkiely 10y agoHow are you different from Picnic Health or CareSync?
- pfletcherhill 10y agoGood question, hkiely! There are a number of great products out there to help people manage medical data—those are certainly two of them. Our focus at PatientBank right now is on just one piece of that problem: making sure people don't have to request their medical records over fax or in-person. What that means is that our market often differs from folks who use a personal health record. Many of our users have been asked by their doctor, their insurance company, or a lawyer to gather and share their medical records—sometimes even from just one specialist or hospital—and they want help doing so.
- z3ugma 10y agoA good amount of your icons etc use "PB" as the abbreviation. In the US healthcare system, "PB" is often used for "professional billing," a function that the medical records department is often closely involved with. I can see this confusing the hospital customers who are providing the data.
- contingencies 10y agoInteresting. Last year my wife and I founded a mainland China outbound medical tourism business and had to get in to this stuff to facilitate servicing our customers. Of course, the Chinese system is very different to the US system. That said, mostly these customers are interested in the US or Europe (for cancer and other serious operations) or Southeast Asia for lesser stuff. China is a HUGE and WEALTHY market just waiting for a decent player in this space. However, I am now focusing on another business (http://8-food.com/ http://8-food.com/) and the focus of the business has shifted so that the average client has their medical records to be re-generated by foreign medical service providers. This is not ideal in some situations, such as remote second diagnosis (which I believe will grow steadily in popularity). If you would like a local partner for digitizing available records in China so that wealthy Chinese can access foreign medical service providers (high resolution film scanning, medical records translation, etc.), you could do worse than talking to us. Email in profile.