Background

Recognizing the potential value of IT for public and private health  systems, the federal government has, for several years, been working to  promote the nationwide use of health IT. In April 2004, President Bush  called for widespread adoption of interoperable electronic health records  within 10 years and issued an executive order that established the  position of the National Coordinator for Health IT within HHS. The  National Coordinator’s responsibilities include developing, maintaining,  and directing the implementation of a strategic plan to guide the  nationwide implementation of interoperable health IT in both the public  and private sectors. According to the strategic plan, the National  Coordinator is to lead efforts to build a national health IT infrastructure  that is intended to, among other things, ensure that patients’ individually  identifiable health information is secure, protected, and available to the  patient to be used for medical and nonmedical purposes, as directed by  the patient and as appropriate.
In January 2007, we reported on the steps that HHS was taking to ensure  the protection of personal health information exchanged within a  nationwide network and on the challenges facing health information  exchange organizations in protecting electronic personal health  information. We reported that although HHS and the Office of the  National Coordinator had initiated actions to identify solutions for  protecting electronic personal health information, the department was in  the early stages of its efforts and had not yet defined an overall privacy  approach. As described earlier, we made recommendations regarding the  need for an overall privacy approach, which we reiterated in subsequent  testimonies in February 2007, June 2007, and February 2008.
In our report, we described applicable provisions of HIPAA and other  federal laws that are intended to protect the privacy of certain health  information, along with the HIPAA Privacy Rule and key principles that  are reflected in the rule. Table 1 summarizes these principles.
We also described in our report and testimonies challenges associated  with protecting electronic health information that are faced by federal and  state health information exchange organizations and health care providers.  These challenges are summarized in table 2.
We reported that HHS had undertaken several initiatives intended to  address aspects of key principles and challenges for protecting the privacy  of health information. For example, in 2005, the department awarded four  health IT contracts that included requirements for developing solutions to  comply with federal privacy requirements and identifying techniques and  standards for securing health information.

	HHS Has Taken Steps to Address Privacy Principles and Challenges, but It Has Not Fully Implemented an Overall Privacy Approach

Since January 2007, HHS has undertaken various initiatives that are  contributing to its development of an overall privacy approach, although  more work remains. We recommended that this overall approach  include (1) identifying milestones and the entity responsible for integrating  the outcomes of its privacy-related initiatives, (2) ensuring that key  privacy principles in HIPAA are fully addressed, and (3) addressing key  challenges associated with the nationwide exchange of health information.  In this regard, the department has fulfilled the first part of our  recommendation, and it has taken important steps in addressing the two  other parts. Nevertheless, these steps have fallen short of fully  implementing our recommendation because they do not include a process  for ensuring that all key privacy principles and challenges will be fully and  adequately addressed. In the absence of such a process, HHS may not be  effectively positioned to ensure that health IT initiatives achieve  comprehensive privacy protection within a nationwide health information  network.

		HHS Has Taken Steps to Address Privacy Principles and Challenges through Its Various Health IT Initiatives

The department and its Office of the National Coordinator have continued  taking steps intended to address key privacy principles and challenges  through various health IT initiatives. Among other things, these initiatives  have resulted in technical requirements, standards, and certification  criteria related to the key privacy principles described in table 1. The  following are examples of ways that the Office of the National  Coordinator’s health IT initiatives relate to privacy principles reflected in  HIPAA.
As part of its efforts to advance health IT, the American Health  Information Community defines “use cases,” which are descriptions of  specific business processes and ways that systems should interact with  users and with other systems to achieve specific goals. Among other  things, several of the use cases include requirements and specifications  that address aspects of the access, uses and disclosures, and amendments  privacy principles. For example, the “consumer empowerment” use case  describes at a high level specific capabilities that align with the access  principle. It requires that health IT systems include mechanisms that allow  consumers to access their own clinical information, such as lab results and  diagnosis codes, from other sources to include in their personal health  records. The use case also aligns with the uses and disclosures principle  and includes requirements that allow consumers to control access to their  personal health record information and specify which information can be  accessed by health care providers and organizations within health  information networks. Further, the consumer empowerment use case  aligns with the amendments privacy principle, emphasizing the need for  policies to guide decisions about which data consumers should be able to  modify, annotate, or request that organizations change. (Other use cases  that are related to these privacy principles are the “personalized  healthcare” and “remote monitoring” use cases.)
Under HHS’s initiative to implement a nationwide health information  network, in January 2007, four test network implementations, or  prototypes, demonstrated potential nationwide health information  exchange and laid the foundation for the Office of the National  Coordinator’s ongoing network trial implementations. Activities within the  prototypes and the trial implementations are related to privacy principles,  including the security, access, uses and disclosures, and administrative  requirements principles. For example, the prototypes produced specific  requirements for security mechanisms (such as data access control and  encryption) that address aspects of the security principle. Additionally,  the ongoing trial implementations are guided by requirements for using  personal health data intended to address the access, uses and disclosures,  and administrative requirements principles. For example, participants in  the trial implementations are to provide the capability for consumers to  access information, such as registration and medication history data, from  other sources to include in their personal health records, to control access  to self-entered data or clinical information held in a personal health  record, and to control the types of information that can be released from  personal health records for health information exchange. In addition,  organizations participating in the network are required to provide system  administrators the ability to monitor and audit all access to and use of the  data stored in their systems.
The Healthcare Information Technology Standards Panel continued work  to “harmonize” standards directly related to several key privacy principles,  primarily the security principle. In addition, the panel developed  technical guidelines that are intended to address other privacy principles,  such as the authorization principle and the uses and disclosures  principle. For example, the panel’s guidelines specify that systems should  be designed to ensure that consumers’ instructions related to  authorization and consent are captured, managed, and available to those  requesting the health information.
The Certification Commission for Healthcare Information Technology,  which is developing and evaluating the criteria and process for certifying  the functionality, security, and interoperability of electronic health  records, took steps that primarily address the security principle. For  example, the commission defined specific security criteria for both  ambulatory and inpatient electronic health records that require various  safeguards to be in place before electronic health record systems are  certified. Among other things, these safeguards include ensuring that  system administrators can modify the privileges of users so that only those  who have a need to access patients’ information are allowed to do so and  that the minimum amount of information necessary can be accessed by  system users.
The State-Level Health Information Exchange Consensus Project, a  consortium of public and private-sector stakeholders, is intended to  promote consistent organizational policies regarding privacy and health  information exchange. The consortium issued a report in February 2007  that addresses, among other principles, the uses and disclosures privacy  principle. For example, the report advises health information exchange  organizations to maintain information about access to and disclosure of  patients’ personal health information and to make that data available to  patients. The consortium subsequently issued another report in March  2008 that recommended practices to ensure the appropriate access, use,  and control of health information.
Additionally, two of HHS’s key advisory groups continued to develop and  provide recommendations to the Secretary of HHS for addressing privacy  issues and concerns:    The Confidentiality, Privacy, and Security Workgroup was formed in 2006  by the American Health Information Community to focus specifically on  these issues and has submitted recommendations to the community that  address privacy principles. Among these are recommendations related to  the notice principle that the workgroup submitted in February and April  2008. These recommendations stated that health information exchange  organizations should provide patients, via the Web or another means,  information in plain language on how these organizations use and disclose  health information, their privacy policies and practices, and how they  safeguard patient or consumer information. The work group also  submitted recommendations related to the administrative requirements  principle, stating that the obligation to provide individual rights and a  notice of privacy practices under HIPAA should remain with the health  care provider or plan that has an established, independent relationship  with a patient, not with the health information exchange.
The National Committee on Vital and Health Statistics, established in 1949,  advises the Secretary of HHS on issues including the implementation of  health IT standards and safeguards for protecting the privacy of personal  health information. The committee’s recent recommendations related to  HHS’s health IT initiatives addressed, among others, the uses and  disclosures principle. For example, in February 2008, the National  Committee submitted five recommendations to the Secretary that support  an individual’s right to control the disclosure of certain sensitive health  information for the purposes of treatment.
Although the recommendations from these two advisory groups are still  under consideration by the Secretary, according to HHS officials,  contracts for the nationwide health information network require  participants to consider these recommendations when conducting  network trials once they are accepted by the Secretary.
The Office of the National Coordinator also took actions intended to  address key challenges to protecting exchanges of personal electronic  health information. Specifically, state-level initiatives (described below)  were formed to bring stakeholders from states together to collaborate,  propose solutions, and make recommendations to state and federal  policymakers for addressing challenges to protecting the privacy of  electronic personal health information within a nationwide health  information exchange. Outcomes of these initiatives provided specific  state-based solutions and recommendations for federal policy and  guidance for addressing key challenges described by our prior work (see  table 2).
The Health Information Security and Privacy Collaboration is pursuing  privacy and security projects directly related to several of the privacy  challenges identified in our prior work, including the need to resolve legal  and policy issues resulting from varying state laws and organizational-level  business practices and policies, and the need to obtain individuals’  consent for the use and disclosure of personal health information. For  example, the state teams noted the need for clarification about how to  interpret and apply the “minimum necessary” standard, and they  recommended that HHS provide additional guidance to clarify this issue.  In addition, most of the state teams cited the need for a process to obtain  patient permission to use and disclose personal health information, and  the teams identified multiple solutions to address differing definitions of  patient permission, including the creation of a common or uniform  permission form for both paper and electronic environments.
The State Alliance for e-Health created an information protection task  force that in August 2007 proposed five recommendations that are  intended to address the challenge of understanding and resolving legal and  policy issues. The recommendations, which the alliance accepted, focused  on methods to facilitate greater state-federal interaction related to  protecting privacy and developing common solutions for the exchange of  electronic health information.
Beyond the initiatives previously discussed, in June 2008, the Secretary  released a federal health IT strategic plan that includes a privacy and  security objective for each of its strategic goals, along with strategies and  target dates for achieving the objectives.  For example, one of the  strategies is to complete the development of a confidentiality, privacy, and  security framework by the end of 2008, and another is to address  inconsistent statutes or regulations for the exchange of electronic health  information by the end of 2011. The strategic plan emphasized the  importance of privacy protection for electronic personal health  information by acknowledging that the success of a nationwide,  interoperable health IT infrastructure in the United States will require a  high degree of public confidence and trust.
In accordance with this strategy, the Office of the National Coordinator is  responsible for developing the confidentiality, privacy, and security  framework. The National Coordinator has indicated that this framework,  which is to be developed and published by the end of calendar year 2008,  is to incorporate the outcomes of the department’s privacy-related  initiatives, and that milestones have been developed and responsibility  assigned for integrating these outcomes. The National Coordinator has  assigned responsibility for these integration efforts and the development  of the framework to the Director of the Office of Policy and Research  within the Office of the National Coordinator. In this regard, the  department has fulfilled the first part of our recommendation.

		Steps Taken Have Not Fully Implemented an Overall Privacy Approach

While the various initiatives that HHS has undertaken are contributing to  the development and implementation of an overall privacy approach, more  work remains. In particular, the department has not defined a process for  ensuring that all privacy principles and challenges will be fully and  adequately addressed. This process would include, for example, steps for  ensuring that all stakeholders’ contributions to defining privacy-related  activities are appropriately considered and that individual inputs to the  privacy framework will be effectively assessed and prioritized to achieve  comprehensive coverage of all key privacy principles and challenges.
Such a process is important given the large number and variety of  activities being undertaken and the many stakeholders contributing to the  health IT initiatives. In particular, the contributing activities involve a wide  variety of stakeholders, including federal, state and private-sector entities.  Further, certain privacy-related activities are relevant only to specific  principles or challenges, and are generally not aimed at comprehensively  addressing all privacy principles and challenges. For example, the  certification and standards harmonization efforts primarily address the  implementation of technical solutions for interoperable health IT and,  therefore, are aimed at system-level security measures, such as data  encryption and password protections, while the recommendations  submitted by HHS’s advisory committees and state-level initiatives are  primarily aimed at policy and legal issues. Effectively assessing the  contributions of individual activities could play an important role in  determining how each activity contributes to the collective goal of  ensuring comprehensive privacy protection. Additionally, the outcomes of  the various activities may address privacy principles and challenges to  varying degrees. For example, while a number of the activities address the  uses and disclosures principle, HHS’s advisory committees have made  recommendations that the department’s activities more extensively  address the notice principle. Consequently, without defined steps for  thoroughly assessing the contributions of the activities, some principles  and challenges may be addressed extensively, while others may receive  inadequate attention, leading to gaps in the coverage of the principles and  challenges.
In discussing this matter with us, officials in the Office of the National  Coordinator pointed to the various health IT initiatives as an approach that  it is taking to manage privacy-related activities in a coordinated and  integrated manner. For example, the officials stated that the purpose of  the American Health Information Community’s use cases is to provide  guidance and establish requirements for privacy protections that are  intended to be implemented throughout the department’s health IT  initiatives (including standards harmonization, electronic health records  certification, and the nationwide health information network). Similarly,  contracts for the nationwide health information network require  participants to adopt approved health IT standards (defined by the  Healthcare Information Technology Standards Panel) and, as mentioned  earlier, to consider recommendations from the American Health  Information Community and the National Committee on Vital and Health  Statistics when conducting network trials, once these recommendations  are accepted or adopted by the Secretary.
While these are important activities for addressing privacy, they do not  constitute a defined process for assessing and prioritizing the many  privacy-related initiatives and the needs of stakeholders to ensure that  privacy issues and challenges will be addressed fully and adequately.  Without a process that accomplishes this, HHS faces the risk that privacy  protection measures may not be consistently and effectively built into  health IT programs, thus jeopardizing patient privacy as well as the public  confidence and trust that are essential to the success of a future  nationwide health information network.

	Conclusions

HHS and its Office of the National Coordinator for Health IT intend to  address key privacy principles and challenges through integrating the  privacy-related outcomes of the department’s health IT initiatives.  Although it has established milestones and assigned responsibility for  integrating these outcomes and for the development of a confidentiality,  privacy, and security framework, the department has not fully  implemented our recommendation for an overall privacy approach that is  essential to ensuring that privacy principles and challenges are fully and  adequately addressed. Unless HHS’s privacy approach includes a defined  process for assessing and prioritizing the many privacy-related initiatives,  the department may not be able to ensure that key privacy principles and  challenges will be fully and adequately addressed. Further, stakeholders  may lack the overall policies and guidance needed to assist them in their  efforts to ensure that privacy protection measures are consistently built  into health IT programs and applications. As a result, the department may  miss an opportunity to establish the high degree of public confidence and  trust needed to help ensure the success of a nationwide health information  network.

	Recommendation for Executive Action

To ensure that key privacy principles and challenges are fully and  adequately addressed, we recommend that the Secretary of Health and  Human Services direct the National Coordinator for Health IT to include in  the department’s overall privacy approach a process for assessing and  prioritizing its many privacy-related initiatives and the needs of  stakeholders.

	Agency Comments and Our Evaluation

HHS’s Assistant Secretary for Legislation provided written comments on a  draft of this report. In the comments, the department generally agreed  with the information discussed in our report; however, it neither agreed  nor disagreed with our recommendation.
HHS agreed that more work remains to be done in the department’s efforts  to protect the privacy of electronic personal health information and stated  that it is actively pursuing a two-phased process for assessing and  prioritizing privacy-related initiatives intended to build public trust and  confidence in health IT, particularly in electronic health information  exchange. According to HHS, the process will include work with  stakeholders to ensure that real-world privacy challenges are understood.  In addition, the department stated that the process will assess the results  and recommendations from the various health IT initiatives and measure  progress toward addressing privacy-related milestones established by the  health IT strategic plan. As we recommended, effective implementation of  such a process could help ensure that the department’s overall privacy  approach fully addresses key privacy principles and challenges.
HHS also provided technical comments, which we have incorporated into  the report as appropriate. The department’s written comments are  reproduced in appendix II.
We are sending copies of this report to interested congressional  committees and to the Secretary of HHS. Copies of this report will be  made available at no charge on our Web site at www.gao.gov.
If you have any questions on matters discussed in this report, please  contact me at (202) 512-6304 or Linda Koontz at (202) 512-6240, or by  e-mail at melvinv@gao.gov or koontzl@gao.gov. Contact points for our  offices of Congressional Relations and Public Affairs may be found on the  last page of this report. Other contacts and key contributors to this report  are listed in appendix III.

Appendix I: Objective, Scope, and Methodology

Our objective was to provide an update on the department’s efforts to  define and implement an overall privacy approach, as we recommended in  an earlier report. Specifically, we recommended that the Secretary of  Health and Human Services define and implement an overall approach for  protecting health information that would (1) identify milestones and the  entity responsible for integrating the outcomes of its privacy-related  initiatives, (2) ensure that key privacy principles in the Health Insurance  Portability and Accountability Act of 1996 (HIPAA) are fully addressed,  and (3) address key challenges associated with the nationwide exchange  of health information.
To determine the status of HHS’s efforts to develop an overall privacy  approach, we analyzed the department’s federal health IT strategic plan  and documents related to its planned confidentiality, privacy, and security  framework. We also analyzed plans and documents that described  activities of each of the health IT initiatives under the Office of the  National Coordinator and identified those intended to (1) develop and  implement mechanisms for addressing privacy principles and (2) develop  recommendations for overcoming challenges to ensuring the privacy of  patients’ information. Specifically, we assessed descriptions of the  intended outcomes of the office’s health IT initiatives to determine the  extent to which they related to these privacy principles and challenges  identified by our prior work.
To supplement our data collection and analysis, we conducted interviews  with officials from the Office of the National Coordinator to discuss the  department’s approaches and future plans for addressing the protection of  personal health information within a nationwide health information network.
We conducted this performance audit at the Department of Health and  Human Services in Washington, D.C., from April 2008 through September  2008, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contacts and Staff Acknowledgments

	GAO Contacts

	Acknowledgments

In addition to those named above, key contributors to this report were  John A. de Ferrari, Assistant Director; Teresa F. Tucker, Assistant Director;  Barbara Collier; Heather A. Collins; Susan S. Czachor; Amanda C. Gill;  Nancy Glover; M. Saad Khan; Thomas E. Murphy; and Sylvia L. Shanks.

Summary:
Why GAO Did This Study

Although advances in information technology (IT) can improve the quality and other aspects of health care, the electronic storage and exchange of personal health information introduces risks to the privacy of that information. In January 2007, GAO reported on the status of efforts by the Department of Health and Human Services (HHS) to ensure the privacy of personal health information exchanged within a nationwide health information network. GAO recommended that HHS define and implement an overall privacy approach for protecting that information. For this report, GAO was asked to provide an update on HHS's efforts to address the January 2007 recommendation. To do so, GAO analyzed relevant HHS documents that described the department's privacy-related health IT activities.

What GAO Found

Since GAO's January 2007 report on protecting the privacy of electronic personal health information, the department has taken steps to address the recommendation that it develop an overall privacy approach that included (1) identifying milestones and assigning responsibility for integrating the outcomes of its privacy-related initiatives, (2) ensuring that key privacy principles are fully addressed, and (3) addressing key challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of GAO's recommendation, and it has taken important steps in addressing the two other parts. The HHS Office of the National Coordinator for Health IT has continued to develop and implement health IT initiatives related to nationwide health information exchange. These initiatives include activities that are intended to address key privacy principles and challenges. For example: (1) The Healthcare Information Technology Standards Panel defined standards for implementing security features in systems that process personal health information. (2) The Certification Commission for Healthcare Information Technology defined certification criteria that include privacy protections for both outpatient and inpatient electronic health records. (3) Initiatives aimed at the state level have convened stakeholders to identify and propose solutions for addressing challenges faced by health information exchange organizations in protecting the privacy of electronic health information. In addition, the office has identified milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, as recommended. Further, the Secretary released a federal health IT strategic plan in June 2008 that includes privacy and security objectives along with strategies and target dates for achieving them. Nevertheless, while these steps contribute to an overall privacy approach, they have fallen short of fully implementing GAO's recommendation. In particular, HHS's privacy approach does not include a defined process for assessing and prioritizing the many privacy-related initiatives to ensure that key privacy principles and challenges will be fully and adequately addressed. As a result, stakeholders may lack the overall policies and guidance needed to assist them in their efforts to ensure that privacy protection measures are consistently built into health IT programs and applications. Moreover, the department may miss an opportunity to establish the high degree of public confidence and trust needed to help ensure the success of a nationwide health information network.