IT services at your practice: In-house or outsourced?

©Syda Productions/Shutterstock.com

Small medical practices must perform many IT functions-among others, EHR system management, cybersecurity, imaging, billing, and controlling and keeping tabs on infrastructure operations-to achieve the clinical and financial outcomes necessary for their success. While most such offices don’t have in-house IT staff, some do, whether they train existing personnel to perform these functions or hire dedicated staff who already have these skills. 

This article looks at both approaches, examining the pros and cons of each, and when, or if, it can make sense to combine the two.

Before a practice decides who will handle its IT, it must know what IT functions are essential to clinical and financial success. EHRs are a given, but so is a practice management system whose patient data can be integrated with the health records and that creates a workflow that expedites patient appointments. 

To accomplish this, the EHR must have an API (Application Programming Interface) that has easy back-and-forth communication with the management system, and both components must be HIPAA-compliant. In addition, while it isn’t mandatory, it’s certainly desirable to have a patient portal that lets patients access their appointment schedules and records online. 

Costs and risks

The major trade off with hiring IT staff versus outsourcing the function is that a practice has greater operational control with staff, but assumes higher costs and risks. says Graham Caparulo, principal consultant with Diligex, a New York City-based provider of IT services to small and medium-sized medical practices. 

“On the risk side, if you have your own staff and a data breach, there’s no one to point the finger at except yourself,” Caparulo says. (Under the HIPAA Omnibus Rule, if the contractor has signed a HIPAA Business Associate agreement with the practice to comply with HIPAA privacy, security and breach notification requirements, it is liable for any HIPAA infractions it commits.)

Contracting out IT lets a practice focus on its core business of providing healthcare. Moreover, the practice may get a broad base of contract employees with a wide variety of technical competencies, and it’s not left exposed if the in-house IT staffer gets sick, goes on vacation, or leaves the practice. 

“The average tenure of an IT person is about two or three years,” says Caparulo, “so do you want to go through this every couple of years or shift that over to somebody else?”

Before hiring outside contractors, the practice needs to conduct a thorough internal inventory to determine what the staff members and doctors already know about the existing IT system, identify their IT product and service needs, and then develop a Request for Proposals based on those precise needs.

“For instance, do you need to select a system?” says Ken Hertz, FACMPE, a principal with MGMA Health Care Consulting Group, in Englewood, Colo. “Is it hardware you need? Is it networking? Is it EHR selection? There’s so many services that external vendors offer that you need to be very clear about what it is that you want to get.”

Training and super users

At some point, however, it makes sense for a small practice to hire some in-house IT staff, for what Caparulo calls “level one or front-end triage issues,” such as if a front-desk staffer can’t log in to the EHR, access e-mail, or print out a medical record. In those instances, it’s better to have a technically adept practice employee on hand to solve the problem. 

“They’ll likely get things resolved quicker than if they go through an outsourced provider,” says Caparulo.

Alternatively, a practice might train its own employees-even if they have little or no IT experience-instead of hiring new personnel. While this certainly costs much less than hiring a full-time IT staffer, the questions become: is it worth the time to train a tech neophyte on the practice’s staff, and will the growth in size and complexity of an IT structure make it too difficult for that staffer to manage in the future? It might be easier to choose this path if the practice’s IT vendor makes training and system support part of the technology purchase cost.

On the other hand, Hertz posits that many workers today are comfortable with sophisticated digital technology. These staffers can use their familiarity to learn the workings of the EHR and perform certain IT functions in a practice, potentially removing the need for a full-time IT staff person. These “super-users” can be and “are highly trained in software, and in understanding and problem-solving with the EHR or practice management software. A vendor can furnish that training.”

However, “they’re not going to solve your network problems and things like that,” Hertz cautions. Even so, he notes, super-users who develop more experience handling software can sometimes help with networking and hardware problems. One caveat, though: super-users have other jobs in the practice that they could neglect if called upon to spend hours diagnosing and fixing an IT problem.

Thus the more complex services, such as interoperability and telemedicine, ought to be left to contract experts, Hertz says. “You want somebody who knows all about HIPAA issues, cybersecurity issues, encoding messages and so forth, so that’s where you’re going to use outsourced vendors.” Specifically, Hertz recommends that a practice should have “one really good external, outsourced IT support” vendor it can rely upon for  guidance in these areas. 

When to subcontract

For some small practices-like that of Karen Smith, MD, a family physician in rural Raeford, N.C.-hiring new or training existing in-house staff isn’t an option. First, the cost is prohibitive-about $30,000 per year, according to practice administrator Michael Hendricks. That would be an operations budget-buster for Smith, who also has a practice manager, registered medical assistant, part-time nurse practitioner, and billing coordinator on staff.

Second, it’s more practical to use a sub-contractor from nearby Fort Bragg to provide IT support, just as he does in his full-time position on the base. (This sub-contractor’s predecessor, another Ft. Bragg IT specialist, originally set up Smith’s IT systems and made the practice completely paperless.) 

“Even if we had an IT specialist to come in and train us it’s out of our purview because we would literally have to study that technology and know what the upgrades are,” explains Smith, adding that it’s “far more cost-effective” to leave that up to her sub-contractor, who does this every day for the U.S. Army.

Moreover, each service the practice installs, like the patient portal Smith is about to install for opioid addiction treatment, or the telepsychiatry functionality her practice has had for some time (to offset the dearth of pediatric psychiatrists in the state), always comes with training costs. Here, too, it’s much better having an IT-savvy sub like Moore learn this, “because we just don’t have the knowledge base for it,” Smith admits.

It’s also highly important that the contractor have an industry-specific knowledge base. “Subcontract with someone who stays up to date with technology and who understands healthcare,” Smith urges. “You really need an IT person who understands the nuances of medicine”-e.g., the kind of ­person who knows that since CMS (the Centers for Medicare & Medicaid) might change its rules next year, you’ll need to be prepared to upgrade data security so that you can qualify for CMS’s Merit-based Incentive Payment System.

Response time and cost

A practice must know when a vendor can be available onsite to solve problems and how much downtime to expect, so the contract should address vendor response time. “They may say, ‘Yeah, we said we’d be onsite, but didn’t you read the part of the contract where we said we’d probably be there within three days?’” Hertz says.

You also should understand how the pricing works for your IT services. With more labor-intensive functions, such as a help desk, “you’re often going to see that those may run up a bill depending upon the number, length, and complexity of calls,” Hertz says. Some specific services, such as help with moving into an office, designing cabling, arranging for wi-fi, or teaching remote access to your doctors can be costly, too. But vendors may charge a reduced monthly fee for certain standard services, such as security, anti-virus security, back-up, monitoring alerts, and hardware support.