Software supplier said nothing about flaw for 18 months, says HSE

Change Healthcare’s delay in informing Irish health service is ‘of grave concern’

HSE director general Tony O’Brien: “One would consider that anything that concerns clinical safety would be of the highest priority and that all efforts would be made to minimise potential harm.”  Photograph: Sam Boal/Rollingnews.ie
HSE director general Tony O’Brien: “One would consider that anything that concerns clinical safety would be of the highest priority and that all efforts would be made to minimise potential harm.” Photograph: Sam Boal/Rollingnews.ie

The Health Service Executive has said the supplier of one of its main computer systems kept it in the dark for18 months about a major glitch.

The flaw, which may result in thousands of patients having to have medical tests redone, was known to the company, Change Healthcare, in January 2016, according to the HSE.

"Of grave concern to me, Change Healthcare did not inform us about this issue at this time," said HSE director general Tony O'Brien in a memo to colleagues, seen by The Irish Times.

“As far as we are aware, no other customers in other jurisdictions were informed. There are 54 hospitals in the USA using this solution in the same way as we do in Ireland and many other organisations around the world.”

READ MORE

The glitch spotted in the HSE’s system for storing scans means the “less than” symbol (<) is omitted when records are archived. This could lead to a doctor overestimating the seriousness of a patient’s condition and ordering unnecessary procedures.

The HSE says that once it understands the scale of the problem, it will start discussion with the company regarding liability for the cost of a recall process.

Mr O’Brien said the company had informed the HSE the problem was first identified in January 2016, and involved a number of characters, including the “#” and “<” signs. He said it was of grave concern that the Irish health service was not informed at this time.

Patch issued

In August 2016, Change Healthcare issued a patch containing a fix for the problem but the accompanying release note made no reference to an issue with characters.

This was an "oversight", Mr O'Brien said the company told the HSE this week, after the error was reported in The Irish Times on Wednesday.

“One would consider that anything that concerns clinical safety would be of the highest priority and that all efforts would be made to minimise potential harm. This includes being open and transparent and providing sufficient information to allow us as clients to inform our patients.”

Some 23,302,968 records have been created in the last six years on the National Integrated Medical Imaging System (Nimis) for 6,109,043 people. A total of 21,131 records were impacted by the “<” error over that time.

The contract for installing Nimis was awarded almost a decade ago to McKesson, based in Tennessee. In February 2016, McKesson and Change Healthcare combined into a new $3 billion organisation known as Change Healthcare based in Vancouver, Canada.

The company, which has a small Irish operation, continues to work with the HSE and installed a fix for the problem last week after it was identified.

The HSE is working to establish what effect the error had on patient outcomes in 2,500 of the affected scans. It says it will widen the investigation to cover more affected scans if it turns out that large numbers of patients were affected.

Paul Cullen

Paul Cullen

Paul Cullen is a former heath editor of The Irish Times.