Contemporary Issues in Medical Informatics: Good Health IT, Bad Health IT, and Common Examples of Healthcare IT Difficulties
Health Care Information Technology Vendors' "Hold Harmless" and “Keep Defects Secret” Clauses

Health Care Information Technology Vendors' "Hold Harmless" and “Keep Defects Secret” Clauses

In the remarkable article Health Care Information Technology Vendors' "Hold Harmless" Clause - Implications for Patients and Clinicians, Ross Koppel and David Kreda, Journal of the American Medical Association, 2009;301(12):1276-1278, we learn that:

Healthcare information technology (HIT) vendors enjoy a contractual and legal structure that renders them virtually liability-free—“held harmless” is the term-of-art—even when their proprietary products may be implicated in adverse events involving patients. This contractual and legal device shifts liability and remedial burdens to physicians, nurses, hospitals, and clinics, even when these HIT users are strictly following vendor instructions...HIT vendors are not responsible for errors their systems introduce in patient treatment because physicians, nurses, pharmacists, and healthcare technicians should be able to identify—and correct—any errors generated by software faults.


[Yes - we're all knowing magicians with the power to read minds, infer incorrect lab values via therapeutic touch, and possess encyclopedic knowledge in our heads at all times. This raises the question: if we are that omniscient to be able to identify and correct software faults with 100 percent accuracy to avoid patient harm, then why do we need electronic medical records at all? - ed.]

Also see the Univ. of Pennsylvania press release "Why Are Healthcare Information Manufacturers Free of All Liability When Their Products Can Result in Medical Errors?" here.

In the new Koppel and Kreda JAMA article we also learn that:

HIT implementations are massively complex, and are fraught with delays, errors, resistance, work process redesign, frustration, and outright failure. Healthcare facilities cannot predict the myriad scenarios in which software failures could result in patient harm and liability, and they are not likely to be knowledgeable a priori about frequent vendor updates.

We additionally learn that:

The significant disparity between buyers and sellers in knowledge and resources [about healthcare IT problems] is profound and consequential. Vendors retain company confidential knowledge about designs, faults, software-operations, and glitches. Their counsel have crafted contractual terms that absolve them of liability and other punitive strictures while compelling users’ non-disclosure of their systems’ problematic, or even disastrous, software faults.

[This is simply astonishing. In other words, health IT customers and users have a gag order imposed on them regarding software faults and defects, while clinicians -- through their ingenuity, their labor in finding defect workarounds, and their liability -- serve (as I've written) as captive beta testers and an insurance company for HIT vendors - ed.]

These observations are nothing short of astonishing. They do help explain, however, the near silence of hospitals and their executives regarding healthcare IT faults, an observation I made in this 2006 AMIA presentation about the scarcity of such information:

Access Patterns to a Website on Healthcare IT Failure (Abstract [pdf], Poster [ppt].)

The Joint Commission also made this observation in their Dec. 2008 Sentinel Events Alert on Health IT:

There is a dearth of data on the incidence of adverse events directly caused by HIT overall.

The new JAMA article may also explain why HIT is so often done so poorly as to present a mission hostile user experience, as I started to write about a decade ago at my healthcare IT difficulties website here, as I outlined in an eight part series starting here, as the American College of Physician Executives noted here, as the National Research Council noted here ("Current Approaches to US Healthcare IT are Insufficient"), and as many others noted as well:

Healthcare IT News (3/10, Merrill) reported, a survey conducted by the American College of Physician Executives found "that although more physician leaders are using healthcare information technology, they still find it clunky and unresponsive to their needs." The survey of 1,000 ACPE members "revealed that the biggest source of frustration is a lack of input from physicians when designing and implementing healthcare information technology systems. Many said involving clinicians at the planning stages would pre-empt many of the problems that crop up later." One respondent noted that "systems are chosen according to administrative criteria rather than what physicians need."

Without accountability, a manufacturer is unmotivated to produce quality products at the expense of profits. They become complacent and lazy. This is an excellent reason why major HIT applications are as abhorrent as they are and violate so many fundamental principles of human computer interaction and resilience engineering.

It can also explain why talent management within the vendors is biased against hiring medical informatics experts, who would resist intellectual laziness of their non-informatics profit oriented (and unaccountable) counterparts.

Koppel and Kreda note that such stipulations defeat patient safety efforts and are contrary to the principles of evidence based medicine. I can add that such stipulations are contrary to the principles of good engineering.

These stipulations further instantiate my observation that health IT lacks the rigor of medical science itself, its major Achilles heel. This is one reason why I believe a national HIT initiative at this point in time is going to be, as in the UK, nothing short of an expensive debacle.

The existence of "hold harmless" clauses and gag orders raises many questions:

  • Clinical supervisors of other physicians are indeed practicing medicine. Are Health IT vendors in fact practicing medicine by cybernetic proxy via these IT systems?
  • Aren't the vendors' own claims of revolutionary healthcare quality improvements mediated via EMR's, alerts and reminders, clinical decision support, etc., malfunctions of which physicians may be held liable, prima facie evidence that the vendors are in fact practicing medicine by proxy?
  • Should not these purveyors of cybernetic (i.e., virtual) medical devices be held accountable for their products, as in the pharmaceutical and the non-cybernetic (i.e., physical) medical device industries?
  • How did such a situation regarding critical healthcare devices arise?
  • In what other healthcare or other technology intensive industries, if any, do similar conditions exist, and what are the repercussions?
  • How long has this situation existed?
  • Why is it tolerated by clinicians?
  • Why is it tolerated by clinical leaders?
  • Why is it tolerated by medical professional societies, such as the AMA, the ACPE, etc., supposedly representing their members' interests?
  • Why is it tolerated by hospitals and their executive leadership and boards of directors?
  • Why is it tolerated by IS departments in hospitals?
  • Why is it tolerated by hospital general counsel?
  • Are there possible civil tort/RICO (racketeering)/criminal implications regarding patients injured by defective health IT where defects were known but not disclosed?
  • Is not such a protective arrangement prima facie evidence that this technology is indeed experimental, with patients and clinicians as unconsented experimental subjects?
  • Why is it tolerated by our government?

Regarding the last point, the Obama administration has promised an atmosphere of national accountability and responsibility. Why, then, has it simultaneously employed the coercive force of government (payment penalties for HIT non adopters after the absurdly short period of five years from now, 2014) to push an exploratory medical device from an unaccountable industry of unproven ROI at a cost of tens of billions of dollars on to the medical profession? This reality raises another question as I suggested in my WSJ Letter to the Editor of February 18, 2009. I wrote:

Dear Wall Street Journal:

You observe that the true political goal is socialized medicine facilitated by health care information technology. You note that the public is being deceived, as the rules behind this takeover were stealthily inserted in the stimulus bill.

I have a different view on who is deceiving whom. In fact, it is the government that has been deceived by the HIT industry and its pundits. Stated directly, the administration is deluded about the true difficulty of making large-scale health IT work. The beneficiaries will largely be the IT industry and IT management consultants.

In other words, was the administration misled by the health IT industry? I believe it might have been.

As an example, Mr. Obama's healthcare IT policy campaign adviser per the WSJ Glen Tullman, CEO of HIT vendor AllScripts and Board member of the industry-created government contractor CCHIT ("Certification Commission for Healthcare IT"), probably didn't tell Mr. Obama his company was selling goods that did not function properly. (Here is a link to my organization's Civil Complaint against AllScripts, PDF). We apparently cannot know how many other organizations had their own complaints that might not have made it into litigation, due to the aforementioned gag orders. (Ironically, I found out about the lawsuit at my own organization only through an anonymous comment at the HIT gossip site HISTalk.)

Incidentally, by matter of pure speculation, I was not permitted involvement in that implementation despite having been a pioneering CMIO at a larger healthcare system years prior and the only formally educated medical informaticist at my organization. My writings on health IT dysfunction were well known to the IT staff and likely the vendor after a short web search; it would have been in the vendors' interests to keep me away from sales and implementation of known deficient health IT. Again, this is simply speculation.

On the other hand, I am aware of major healthcare organizations with "portfolios" of hundreds or thousands of issues and defects awaiting remediation, and CMIO's struggling against cavalier bureaucracies who want the doctors even in critical care areas to live with the problems, and vendors who are not in a hurry to fix their products.

Some of the problems rise to the level of critical with regard to patient safety. Under contract, the problems cannot be disclosed to the public, to patients whose care might fall under the aegis of these systems, or to other healthcare organizations seeking the same systems. I hope to be a plaintiff's witness when the inevitable lawsuits for patient injury place such capricious vendor, hospital and IT leadership on the witness stand.

Finally, in fairness the JAMA article discusses issues beyond the vendors' control such as misuse or poor training done by the host organization using the IT.

Possible remedies to the situation of unaccountability for the outcomes of HIT misdesign, malfunction and other defects are outlined in the article. See it or the press release at the above links if you lack JAMA access.

As I've written numerous times on this site, due to the implications and especially now due to the revelation that the scarcity of adverse events information related to HIT is probably by design, I favor stringent health IT regulation as in pharmaceutical IT.

Whatever happens, however, I know this. For the sake of patient safety:

These inexcusable practices must end.


Regarding healthcare IT "Hold Harmless" and Defects Gag Clauses, I also question whether hospital executives violated their fiduciary responsibilities by signing such contracts, and violated Joint Commission standards of hospital leadership conduct as well.

Fiduciary (fidOO'shēe"rē), in law, a person who is obliged to discharge faithfully a responsibility of trust toward another. Among the common fiduciary relationships are guardian to ward, parent to child, lawyer to client, corporate director to corporation, trustee to trust, and business partner to business partner. In discharging a trust, the fiduciary must be absolutely open and fair. Certain business methods that would be acceptable between independent parties dealing with one another “at arm's length” may expose a fiduciary to liability for having abused a position of trust.

Hospital management conduct is not bound by traditional business law only, just as physicians and other clinicians hold additional obligations. In both cases, obligations go beyond that of, say, a manager or worker at a McDonald's or a Wal-Mart.

I earlier in this essay expressed great concern about the remarkable revelations in Koppel and Kreda's expose of arguably unethical and clearly inexcusable contracting practices by healthcare IT producers and vendors.

The vendors have declared themselves off limits from liability even if patients die as a result of software defects and malfunctions, pushing that liability onto clinicians. Vendors have simultaneously declared themselves the Ministry of Information, Soviet style, on such defects.

I also expressed my concern that the contractual suppression of information dissemination on health IT problems and defects may be one reason websites on health IT difficulties, such as this one started in 1998 (in fact cited by Koppel and Kreda) remain uncommon on the Web. This is despite my documentation of continued, ongoing, world wide interest in this topic (see my 2006 AMIA abstract on this issue here, PDF, and poster here, PPT).

It is not just the vendors who may be acting against the best interests of medical science and patient safety, however.

It also seems to me that hospital executives, boards and counsel have fiduciary responsibilities, as well as obligations under principles of due diligence, Joint Commission and other regulatory guidelines, etc. to protect not just patients from defective technologies but also to protect their staffs from unfair risks and legal liabilities. I note that these health IT contracts have apparently been signed willingly by hospital executives, against the best interests of patients and medical staffs. Nobody is holding a gun to their heads, and nobody is forbidding negotiation of terms.

As a former CMIO/Director of Informatics I would never have signed such a contract. Period. (Of course, CMIO's and Directors of Informatics don't generally sign or even see health IT contracts, as they are Chiefs and Directors of Nothing.)

Have hospital executives, boards of directors and counsel been violating their responsibilities and obligations every time they've signed a healthcare IT "hold vendors harmless, it's all on your docs" and "shhhh! keep the defects secret" contract? Have they abused their positions of trust?

NIH research leaders and grant reviewers, as an example, consider seriously any problems with research that might place not just research subjects but also investigators at risk, medically, legally and otherwise. I perform this function on NIH study section panels.

Let's look at the Joint Commission Hospital Accreditation Program Leadership Chapter, and its standards for hospital leadership (link, PDF):


Standard LD.01.03.01
The governing body is ultimately accountable for the safety and quality of care, treatment, and services.

Rationale for LD.01.03.01
The governing body’s ultimate responsibility for safety and quality derives from their legal responsibility and operational authority for [organization] performance. In this context, the governing body provides for internal structures and resources, including staff, that support safety and quality.

The governing body has a legal responsibility for safety and quality, not just a moral obligation. One of the "internal structures" is healthcare IT that is safe and effective and that does not expose patients or staff to undue risks.

How does signing "hold harmless" and "defects gag order" clauses with an HIT vendor serve such a purpose, exactly?

Hospital executives know, should know, or should have known that such provisions would remove incentives for health IT vendors to produce the best products and to correct deficiencies rapidly, thus increasing risk to patients and clinicians.

Elements of Performance for LD.01.03.01
5. The governing body provides for the resources needed to maintain safe, quality care, treatment, and services.

One of those resources is health IT.

Standard LD.02.01.01
The mission, vision, and goals of the [organization] support the safety and quality of care, treatment, and services.

Rationale for LD.02.01.01
The primary responsibility of leaders is to provide for the safety and quality of care, treatment, and services. The purpose of the [organization]’s mission, vision, and goals, is to define how the [organization] will achieve safety and quality. The leaders are more likely to be aligned with the mission, vision, and goals when they create them together. The common purpose of the [organization] is most likely achieved when it is understood by all who work in or are served by the [organization].

How is a contract with an HIT vendor that calls for hiding defects in health IT and exposing staff to liability for defects in same serving the above purposes?

Standard LD.02.03.01
The governing body, senior managers and leaders of the organized medical staff regularly communicate with each other on issues of safety and quality.

Does that include communication on health IT defects? Can a medical staff member ask to see a database of such defects when the hospital has signed a nondisclosure of defects agreement with an HIT vendor?

Rationale for LD.02.03.01
Leaders, who provide for safety and quality, must communicate with each other on matters affecting the [organization] and those it serves.

I ask the same question as above.

Standard LD.03.01.01
Leaders create and maintain a culture of safety and quality throughout the [organization].

Safety for whom, exactly? Patients, or patients and staff?

How is exposing professional staff to undeserved liability from defective health IT serving the creation of a culture of safety and quality for them? How is suppressing information on health IT defects and problems helping patient safety and care quality?

How is lack of seeking informed consent on health IT use from patients whose care is mediated by health IT devices with known but undisclosable defects creating a culture of quality?

How is hiding such defects creating a culture of quality in the community's other hospitals, that may be considering purchase of the very same health IT?

Standard LD.03.04.01
The [organization] communicates information related to safety and quality to those who need it, including staff, licensed independent practitioners, [patient]s, families, and external interested parties.

Rationale for LD.03.04.01
Effective communication is essential among individuals and groups within the [organization], and between the [organization] and external parties. Poor communication often contributes to adverse events and can compromise safety and quality of care, treatment, and services. Effective communication is timely, accurate, and usable by the audience.

Are physicians and nurses explicitly informed by administration that clinicians are liable for bad outcomes due to software problems? Are they informed of the gag clause? Are patients informed of unremediated health IT defects existing at time of service?

This standard seems a veritable smoking gun regarding breach of fiduciary responsibility and Joint Commission obligations when hospital leadership signs agreements specifically excluding the sharing information about health IT defects and complaints. It is already known that hospitals maintain lists of health IT defects, some in the thousands of items. A number of the defects rise to the level of creating considerable risk to patients, and nobody is in a hurry to remediate them. (See my proposed although somewhat tongue in cheek "HIT Informed Consent" that describes some of these known defect categories here).

Standard LD.04.04.03
New or modified services or processes are well-designed.

... 3. The hospital's design of new or modified services or processes incorporates: Information about potential risks to patients.

4. The hospital's design of new or modified services or processes incorporates: Evidence-based information in the decision-making process. Note: For example, evidence-based information could include practice guidelines, successful practices, information from current literature, and clinical standards.

How does the contractual inability to communicate about health IT defects, which its executives willingly sign, serve this purpose?

Standard LD.04.04.05
The [organization] has an organization-wide, integrated [patient] safety program.

... 12. The hospital disseminates lessons learned from root cause analyses, system or process failures, and the results of proactive risk assessments to all staff who provide services for the specific situation.

Disseminates lessons learned, except when the HIT contract they've signed with a vendor forbids it, that is.

The practices of the health IT industry, and the dealings of the hospital leadership with that industry, may in fact be a scandal of national (or international) proportions.

I urge physicians and concerned others reading this to read the Univ. of PA press release "Why Are Healthcare Information Manufacturers Free of All Liability When Their Products Can Result in Medical Errors?" here, obtain the JAMA article by Koppel and Kreda, and call their congressional and other representatives to have these self-serving industry practices that ignore protection of patients and practitioners from undue jeopardy stopped.