United States Government Accountability Office

GAO Testimony

Before the Subcommittee on Federal 

Workforce and Agency Organization, 

Committee on Government Reform, 

House of Representatives 

HEALTH INFORMATION 

TECHNOLOGY 

For Release on Delivery 

Expected at 1:00 p.m. CDT

Friday, September 1, 2006

HHS is Continuing Efforts 

to Define Its National 

Strategy 

Statement of David A. Powner 

Director, Information Technology Management Issues 

GAO-06-1071T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 1, 2006

HEALTH INFORMATION TECHNOLOGY

HHS is Continuing Efforts to Define Its 

Highlights of GAO-06-1071T, a testimony National Strategy 

before the Subcommittee on Federal 

Workforce and Agency Organization, 

Committee on Government Reform, 

House of Representatives

As GAO and others have 

reported, the use of information 

technology (IT) has enormous 

potential to improve the quality of 

health care and is critical to 

improving the performance of the 

U.S. health care system. Given the 

federal government’s role in 

providing health care in the U.S., 

it has been urged to take a 

leadership role in driving change

to improve the quality and 

effectiveness of health care, 

including the adoption of IT. In 

April 2004, President Bush called 

for widespread adoption of 

interoperable electronic health 

records within 10 years and 

issued an executive order that 

established the position of the 

National Coordinator for Health 

Information Technology. A 

National Coordinator within the 

Department of Health and Human 

Services (HHS) was appointed in 

May 2004 and released a 

framework for strategic action 

two months later. In May 2005,

GAO recommended that HHS 

establish detailed plans and 

milestones for each phase of the 

framework and take steps to 

ensure that its plans are followed 

and milestones are met. 

GAO was asked to identify 

progress made by HHS toward 

the development and 

implementation of a national 

health IT strategy. To do this, 

GAO reviewed prior reports and 

agency documents on the current 

status of relevant HHS activities. 

In late 2005, to help define the future direction of a national strategy, HHS 

awarded several health IT contracts and formed the American Health 

Information Community, a federal advisory committee made up of health 

care stakeholders from both the public and private sectors. Through the 

work of the these contracts and the community, HHS and its Office of the 

National Coordinator for Health IT have made progress in five major areas 

associated with the President’s goal of nationwide implementation of health 

IT (see table). 

Five Areas of Progress and Supporting Activities 

Areas of progress Activities 

Advancing use of

electronic health records 

• Defined initial certification criteria for certain electronic health 

records and certified 22 vendors’ products. 

• Presented functional requirements for inclusion of patient 

information into electronic health records. 

• Initiated work to advance the use of electronic health records to 

rebuild medical records following disasters. 

Establishing 

interoperability standards

for a health information 

exchange 

• American National Standards Institute Health IT Standards Panel 

selected 90 interoperability standards for areas such as electronic

health records and public health detection and reporting. 

• Coordinated with the National Institute for Standards and 

Technology to align federal and private sector standards for 

interoperable health IT. 

Developing prototypes of 

a nationwide health 

information network 

• Awarded contracts for developing prototypes for a national network 

to four contractors. 

• Proposed more than 1000 functional requirements. 

• Held the first nationwide health information forum.

Addressing privacy and 

security issues 

associated with the 

nationwide exchange of 

health information 

• Contracted with 34 states and territories to perform assessments 

of the impact of policies and laws on security and privacy 

practices. 

• Selected standards to help ensure privacy and confidentiality. 

• Formed a new workgroup to specifically address privacy and 

security policy issues. 

• Made recommendations covering topics that are central to 

challenges for protecting health information privacy in a national 

health information exchange environment. 

Integrating public health 

systems into a national 

network 

• Made recommendations to help support sharing of clinical care 

data with local, state, and federal biosurveillance programs,

including the development of materials for public education on 

benefits to public health and national security, and the protection of 

patient confidentiality. 

• Selected information exchange standards for sharing clinical 

health information with public health. 

Source: GAO analysis of HHS data 

These activities and others are being used by the Office of the National 

Coordinator for Health IT to continue its efforts to complete a national 

strategy to guide the nationwide implementation of interoperable health IT. 

Since the release of its initial framework in 2004, the office has defined 

objectives and high-level strategies for accomplishing its goals. Although 

HHS agreed with GAO’s prior recommendations and has made progress in 

these areas, it still lacks detailed plans, milestones, and performance 

measures for meeting the President’s goals. 

 

www.gao.gov/cgi-bin/getrpt?GAO-06-1071T.

To view the full product, including the scope 

And methodology, click on the link above. 

For more information, contact David A. 

Powner at (202) 512-9286 or 

pownerd@gao.gov. 
Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to comment on federal efforts to 

advance the use of information technology (IT) for health care 

delivery and public health. As we and others have reported, the use 

of IT has enormous potential to improve the quality of health care 

and is critical to improving the performance of the U.S. health care 

system. 

Recognizing the potential value of IT in public and private health 

care systems, the federal government has been working to promote 

the nationwide use of health IT.1

 In April 2004, President Bush called 

for widespread adoption of interoperable electronic health records 

within 10 years and issued an executive order2

 that established the 

position of the National Coordinator for Health Information 

Technology within the Department of Health and Human Services 

(HHS). The National Coordinator’s responsibilities include the 

development and implementation of a strategic plan to guide the 

nationwide implementation of interoperable health IT in both the 

public and private sectors. 

At your request, today we will discuss progress made by HHS and its 

Office of the National Coordinator for Health IT toward the 

development and implementation of a national health IT strategy. In 

preparing this statement, we reviewed agency documents on the 

current status of HHS’s activities related to a national health IT 

strategy and supplemented our analysis with interviews of agency 

officials. We also summarized prior GAO reports. Our work was 

performed in accordance with generally accepted auditing 

standards. 

 1

 Health IT is the use of technology to electronically collect, store, retrieve, and transfer 

clinical, administrative, and financial health information. 

2

 Executive Order 13335, Incentives for the Use of Health Information Technology and

Establishing the Position of the National Health Information Technology Coordinator

(Washington, D.C.: Apr. 27, 2004). 

Page 1 GAO-06-1071T 
Results in Brief 

HHS and its Office of the National Coordinator for Health IT have 

made progress through the work of the American Health 

Information Community3

 and several recently-awarded contracts4 in 

five major areas: (1) defining certification criteria for and certifying 

electronic health records, (2) identifying interoperability standards 

to facilitate the exchange of patient data, (3) defining requirements 

for the development of prototypes for the Nationwide Health 

Information Network, (4) addressing privacy and security issues 

associated with the nationwide exchange of health information, and 

(5) taking steps to integrate public health into a nationwide health 

information exchange. Specifically, certification criteria for 

ambulatory electronic health records5

 have been defined and 22 

electronic health records vendors have achieved certification for 

their products. Additionally, 90 interoperability standards have been 

selected for areas such as electronic health records and public 

health detection and reporting, and functional requirements for a 

nationwide health information network have been proposed. The 

American Health Information Community has also formed a 

workgroup to specifically address confidentiality and security issues 

relevant to a nationwide health information exchange. 

These activities and others are being used by the Office of the 

National Coordinator for Health IT to continue its efforts to 

complete a national strategy to guide the nationwide 

implementation of interoperable health IT. Since the release of its 

initial framework in 2004, the office has defined objectives and highlevel strategies for accomplishing its goals. However, while HHS has 

 3

 The American Health Information Community is a federally-chartered commission made 

up of representatives from both the public and private health care sectors. 

4

 In late 2005, HHS awarded several contracts to address a range of issues important for 

developing a health IT infrastructure, such as advancing the use of electronic health 

records, selecting health IT standards, developing prototypes of a national network, and 

defining privacy and security policies. 

5

 Ambulatory electronic health records are records of medical care that includes diagnosis,

observation, treatment, and rehabilitation that is provided on an outpatient basis. 

Ambulatory care is given to persons who are able to ambulate, or walk about. 

Page 2 GAO-06-1071T 
made progress in these areas, it still lacks detailed plans, milestones, 

and performance measures for meeting the President’s goals. 

Background 

Studies published by the Institute of Medicine and others have 

indicated that fragmented, disorganized, and inaccessible clinical 

information adversely affects the quality of health care and 

compromises patient safety. In addition, long-standing problems 

with medical errors and inefficiencies increase costs for health care 

delivery in the United States. With health care spending in 2004 

reaching almost $1.9 trillion, or 16 percent, of the gross domestic 

product, concerns about the costs of health care continue. As we 

reported last year, many policy makers, industry experts, and 

medical practitioners contend that the U.S. health care system is in a 

crisis.6

Health IT provides a promising solution to help improve patient 

safety and reduce inefficiencies. The expanded use of health IT has 

great potential to improve the quality of care, bolster the 

preparedness of our public health infrastructure, and save money on 

administrative costs. As we reported in 2003, technologies such as 

electronic health records and bar coding of certain human drug and 

biological product labels have been shown to save money and 

reduce medical errors.7

 For example, a 1,951-bed teaching hospital 

reported that it realized about $8.6 million in annual savings by 

replacing outpatient paper medical charts with electronic medical 

records. This hospital also reported saving more than $2.8 million

annually by replacing its manual process for managing medical 

records with an electronic process to provide access to laboratory 

results and reports. Health care organizations also reported that IT 

contributed other benefits, such as shorter hospital stays, faster 

 6

 GAO, 21st Century Challenges: Reexamining the Base of the Federal Government, GAO05-325SP (Washington, D.C.: February 2005). 

7

 GAO, Information Technology: Benefits Realized for Selected Health Care Functions, 

GAO-04-224 (Washington, D.C.: Oct. 31, 2003). 

Page 3 GAO-06-1071T 
communication of test results, improved management of chronic 

diseases, and improved accuracy in capturing charges associated 

with diagnostic and procedure codes. However, according to HHS, 

only a small number of U.S. health care providers have fully adopted 

health IT due to significant financial, technical, cultural, and legal 

barriers such as a lack of access to capital, a lack of data standards, 

and resistance from health care providers. 

Federal Government’s Role in Health Care 

According to the Institute of Medicine, the federal government has a 

central role in shaping nearly all aspects of the health care industry 

as a regulator, purchaser, health care provider, and sponsor of 

research, education, and training. Seven major federal health care 

programs, such as Medicare and Medicaid, provide health care 

services to approximately 115 million Americans. According to HHS, 

federal agencies fund more than a third of the nation’s total health 

care costs. Table 1 summarizes the programs and number of citizens 

who receive health care services from the federal government and 

the cost of these services. 

Page 4 GAO-06-1071T 
Table 1: Beneficiaries and Expenditures in Major Federal Health Care Programs for 

Fiscal Year 2004 

Federal agency Program Beneficiaries

Expenditure

(in billions) 

HHS Medicare 42 million elderly 

and disabled 

beneficiaries 

$309 

HHS Medicaid 43.7 million lowincome persons276.8 

(joint federal and 

state) 

HHS State Children’s

Health Insurance 

Program 

5.8 million childrena6.6

(joint federal and 

state) 

HHS Indian Health

Service 

1.8 million Native 

Americans and

Alaska Natives

3.7 

Veterans Affairs Veterans Health 

Administration

5.2 million veterans 26.8 

Department of 

Defense 

Tricare Program 8.3 million activeduty military 

personnel and their 

families, and military 

retirees 

30.4 

Office of Personnel 

Management 

Federal Employees 

Health Benefit 

Program 

8 million federal 

employees, retirees, 

and dependents 

27 

Source: HHS, VA, DOD, and OPM budget documents. 

a

Based on fiscal year 2003 data. 

Given the level of the federal government’s participation in 

providing health care, it has been urged to take a leadership role in

driving change to improve the quality and effectiveness of medical 

care in the United States, including an expanded adoption of IT. 

In April 2004, President Bush called for the widespread adoption of 

interoperable electronic health records within 10 years and issued 

an executive order8

 that established the position of the National 

Coordinator for Health Information Technology within HHS. The 

National Coordinator’s responsibilities include the development and 

 8

 Executive Order 13335. 

Page 5 GAO-06-1071T 
implementation of a strategic plan to guide the nationwide 

implementation of interoperable health IT in both the public and 

private sectors. The first National Coordinator was appointed in 

May 2004,9

 and two months later HHS released The Decade of Health 

Information Technology: Delivering Consumer-centric and 

Information-rich Health Care—Framework for Strategic Action, 

the first step toward the development of a national strategy. The 

framework described goals for achieving nationwide 

interoperability of health IT and actions to be taken by both the 

public and private sectors to implement a strategy. Just last week, 

President Bush issued an executive order calling for federal health 

care programs and their providers, plans, and insurers to use IT 

interoperability standards recognized by HHS.10 

Need for a National Strategy and Greater Interoperability 

In the summer of 2004, we testified on the benefits that effective 

implementation of IT can bring to the health care industry and the 

need for HHS to provide continued leadership, clear direction, and 

mechanisms to monitor progress in order to bring about measurable 

improvements.11 Last year, we reported that HHS, through the Office 

of the National Coordinator for Health IT, had taken a number of 

actions toward accelerating the use of IT to transform the health 

care industry. To further accelerate the adoption of interoperable 

health information systems, we recommended that HHS establish 

detailed plans and milestones for meeting the goals of its framework 

for strategic action and take steps to ensure that those plans are 

followed and milestones are met.12 The department agreed with our 

recommendation. 

 9

 This position was vacated by the first national coordinator in May 2006. HHS is currently

in the process of conducting a nationwide search for a new national coordinator and a 

deputy national coordinator. 

10 Executive Order: Promoting Quality and Efficient Health Care in Federal Government 

Administered or Sponsored Health Care Programs (Washington, D.C.: Aug. 22, 2006). 

11 GAO, Health Care: National Strategy Needed to Accelerate the Implementation of 

Information Technology, GAO-04-947T (Washington, D.C.: July 14, 2004). 

12 GAO, Health Information Technology: HHS is Taking Steps to Develop a National

Strategy, GAO-05-628 (Washington, D.C.: May 27, 2005). 

Page 6 GAO-06-1071T 
We also reported in June 2005 that challenges associated with major 

public health IT initiatives still need to be overcome to strengthen 

the IT that supports the public health infrastructure.13 Federal 

agencies face many challenges in their efforts to improve the public 

health infrastructure, including (1) the integration of current 

initiatives into a national health IT strategy and federal architecture 

to reduce the risk of duplicative efforts, (2) development and 

adoption of consistent standards to encourage interoperability, (3) 

coordination of initiatives with state and local agencies to improve 

the public health infrastructure, and (4) overcoming federal IT 

management weaknesses to improve progress on IT initiatives. To 

address these challenges, we recommended that HHS align federal 

public health initiatives with the national health IT strategy and 

federal health architecture, coordinate with state and local public 

health agencies, and continue federal actions to encourage the 

development and adoption of data standards. 

Last September, we testified about the importance of defining and 

implementing data and communication standards to speed the 

adoption of interoperable IT in the health care industry.14 Hurricane 

Katrina highlighted the need for interoperable electronic health 

records as thousands of people were separated from their health 

care providers and their paper medical records were lost. As we 

have noted, standards are critical to enabling this interoperability. 

Although federal leadership has been established to accelerate the 

use of IT in health care, we testified that several actions15 were still 

needed to position HHS to further define and implement relevant 

standards. Otherwise, the health care industry will continue to be 

plagued with incompatible systems that are incapable of exchanging 

 13 GAO, Bioterrorism: Information Technology Strategy Could Strengthen Federal 

Agencies’ Abilities to Respond to Public Health Emergencies, GAO-03-139 (Washington, 

D.C.: May 30, 2003); GAO, Information Technology: Federal Agencies Face Challenges in

Implementing Initiatives to Improve Public Health Infrastructure, (GAO-05-308) 

Washington, D.C.: June 10, 2005). 

14 GAO, Health Care: Continued Leadership Needed to Define and Implement

Information Technology Standards, GAO-05-1054T (Washington, D.C.: Sept. 29, 2005).

15 These actions included the lack of mechanisms for better agency coordination of the

various standards efforts, incomplete milestones associated with these efforts, and no 

mechanism to monitor the implementation of standards across the health care industry. 

Page 7 GAO-06-1071T 
medical information that is critical to delivering care and responding 

to public health emergencies. 

In March 2006, we testified before this subcommittee16 on HHS’s 

continued efforts to move forward with its mission to guide the 

nationwide implementation of interoperable health IT in the public 

and private health care sectors. We identified several steps taken by 

the department, such as the establishment of the organizational 

structure and management team for the Office of the National 

Coordinator for Health IT under the Office of the Secretary and the 

formation of a public-private advisory body—the American Health 

Information Community—to advise HHS on achieving 

interoperability for health information exchange. The community, 

which is co-chaired by the Secretary of HHS and the former National 

Coordinator for Health IT, identified four breakthrough areas17 —

consumer empowerment, chronic care, biosurveillance, and 

electronic health records—and formed workgroups intended to 

make recommendations for actions in these areas that will produce 

tangible results within a one-year period. Subsequently, in May 2006 

the workgroups presented 28 recommendations to the American 

Health Information Community that address standards, privacy and 

security, and data-sharing issues. 

We also reported in March 200618 that HHS—through the Office of 

the National Coordinator for Health IT— awarded $42 million in 

contracts that address a range of issues important for developing a 

robust health IT infrastructure, such as an increasing number of 

health care providers adopting electronic health records, definitions 

of health information standards being developed, architectural 

definitions for a national network, and the development and 

implementation of privacy and security policies. HHS intends to use 

the results of the contracts and recommendations from the 

 16 GAO, Health Information Technology: HHS is Continuing Efforts to Define a National 

Strategy, GAO-06-346T (Washington, D.C.: Mar. 15, 2006). 

17 Breakthrough areas are components of health care and public health that can potentially 

achieve measurable results in 2 to 3 years. 

18 GAO-06-346T. 

Page 8 GAO-06-1071T 
American Health Information Community proceedings to define the 

future direction of a national strategy. In March, the National 

Coordinator told us that he intended to release a strategic plan with 

detailed plans and milestones later this year. The contracts are 

described in table 2. 

 Table 2: Health IT Contracts Awarded by HHS’s Office of the National Coordinator 

 Contract Date awarded Duration

Cost 

(in millions) Description

American Health Information 

Community Program Support

September 2005 1 year $0.8 To provide assistance to the National Coordinator in 

convening and managing the meetings and activities 

of the community to ensure that the health IT plan is 

seamlessly coordinated. 

Standards Harmonization 

Process for Health IT

September 2005 1 year 3.2 To develop and test a process for identifying,

assessing, endorsing, and maintaining a set of 

standards required for interoperable health information 

exchange. 

Compliance Certification 

Process for Health IT

September 2005 1 year 2.7 To develop and evaluate a compliance certification 

process for health IT, including the infrastructure 

components through which these systems 

interoperate. 

Privacy and SecurityaSeptember 2005 11⁄2

years 

17.5

(Increased by 

$6 million in

August 2006 to

include 

additional 

studies)

To assess and develop plans to address variations in

organization-level business policies and state laws 

that affect privacy and security practices that may 

pose challenges to an interoperable health information 

exchange. 

Nationwide Health Information 

Network Prototypes 

November 2005 1 year 18.6

(4 contracts)

To develop and evaluate prototypes for a nationwide 

health information network architecture to maximize 

the use of existing resources such as the Internet to 

achieve widespread interoperability among software 

applications, particularly electronic health records. 

These contracts are also intended to spur technical

innovation for nationwide electronic sharing of health 

information in patient care and public health settings. 

Measuring the Adoption of 

Electronic Health Records 

September 2005 2 years 1.8 To develop a methodology to better characterize and 

measure the state of electronic health records 

adoption and determine the effectiveness of policies 

aimed at accelerating adoption of electronic health 

records and interoperability. 

Gulf Coast Electronic Digital 

Health Recovery 

September 2005 1 year 3.7 To plan and promote the widespread use of electronic 

health records and digital health information recovery 

in the Gulf Coast regions affected by hurricanes last 

year. 

Source: HHS Office of the National Coordinator for Health Information Technology. 

a

Jointly managed by the Agency for Healthcare Research and Quality and the Office of the National 

Coordinator. 

Page 9 GAO-06-1071T 
HHS Is Continuing Efforts to Advance the Nationwide 

Implementation of Health IT and Complete a National Strategy 

HHS and its Office of the National Coordinator for Health IT have 

made progress through the work of the American Health 

Information Community and several contracts in five major areas: 

(1) advancing the use of electronic health records, (2) establishing 

standards to facilitate the exchange of patient data, (3) defining 

requirements for the development of prototypes of the Nationwide 

Health Information Network, (4) incorporating privacy and security 

policy, practices, and standards into the national strategy, and (5) 

integrating public health into nationwide health information 

exchange. 

These activities and others are being used by the Office of the 

National Coordinator for Health IT to continue its efforts to 

complete a national strategy to guide the nationwide 

implementation of interoperable health IT. Since the release of its 

initial framework in 2004, the office has taken additional steps to 

define a complete national strategy, building on its earlier work. 

However, while HHS has made progress in these areas, it still lacks 

detailed plans, milestones, and performance measures for meeting 

the President’s goals. 

HHS Is Advancing the Use of Electronic Health Records 

HHS has made progress toward advancing the adoption of 

electronic health records by defining initial certification criteria for 

ambulatory electronic health records. The Certification Committee 

for Health IT,19 which was awarded the Compliance Certification 

Process for Health IT contract, finalized functionality, security, and 

reliability certification criteria for ambulatory electronic health 

records in May 2006 and described interoperability criteria for 

 19 The Certification Committee for Health IT is a voluntary, private sector organization that 

is working to certify health IT products in three areas: ambulatory electronic health 

records for the office-based physician or provider, inpatient electronic health records for

hospitals and health systems, and the network components through which the electronic 

health records operate and share information. 

Page 10 GAO-06-1071T 
future certification requirements. The committee subsequently 

certified 22 vendors’ electronic health records products in July. Its 

next phase is to define and recommend certification criteria for 

inpatient electronic health records. The committee plans to publish

these criteria for public comment during the last quarter of 2006, 

with certification beginning in the second quarter of 2007. 

Additionally, the Nationwide Health Information Network contracts 

have thus far resulted in the identification of draft functional 

requirements for incorporating lab results and patient information, 

such as medical history and insurance information, into electronic 

health records. The requirements were presented to the Secretary of 

HHS in June 2006, and an initial set of requirements for the 

Nationwide Health Information Network are expected to be issued 

in September 2006. 

In our March 2006 testimony, we described the Gulf Coast 

Electronic Digital Health Recovery contract, which was awarded by 

HHS to promote the use of electronic health records to rebuild 

medical records for patients in the Gulf Coast region affected by 

hurricanes last year. The outcomes of the contract are expected to 

coordinate planning for the recovery of digital health information in 

cases of emergencies or disasters and to develop a prototype of 

health information sharing and electronic health records support. 

The contract established a task force of local and national experts to 

help area providers turn to electronic medical records as they 

rebuild medical records for their patients. 

HHS Has Initiated Steps to Establish Health IT Standards 

HHS awarded its Standards Harmonization Process for Health IT 

contract to ANSI.20 The contract is supported by ANSI’s Health IT 

Standards Panel, a collaborative partnership between the public and 

private sector. This effort integrates standards previously identified 

 20 The American National Standards Institute is a private, nonprofit membership 

organization that coordinates the development and use of voluntary standards in the 

United States. 

Page 11 GAO-06-1071T 
by the Consolidated Health Informatics21 and other federal 

initiatives. To date, the panel has selected 90 interoperability 

standards for areas such as electronic health records and public 

health detection and reporting. The selected standards specifically 

address components of the breakthrough areas defined by the 

American Health Information Community and were produced by 

accepted standards organizations. The Nationwide Health 

Information Network functional requirements also incorporate 

standards defined through the work of the Standards Harmonization 

Process for Health IT contract. The selected standards are currently 

being reviewed for acceptance by the Secretary. 

HHS has also involved the Department of Commerce’s National 

Institute for Standards and Technology (NIST) with HHS’s work to 

implement health IT standards through its standards harmonization

contract. HHS’s standards harmonization contractor is required to 

maximize the use of existing processes and collaborate with NIST 

where appropriate, including consideration of outputs from the 

standards harmonization process as Federal Information Processing 

Standards22 relevant to federal agencies. NIST’s issuance of Federal 

Information Processing Standards for health IT is to be aligned with 

recommendations from public and private sector coordination 

efforts through the American Health Information Community, as 

accepted by the Secretary of HHS. The Federal Information 

Processing Standards are to be consistent with the standards 

adopted by the harmonization contract to enable the alignment of 

federal and private sector standards and widespread interoperability 

among health IT systems, particularly electronic health records 

systems. 

 21 Consolidated Health Informatics was initiated in December 2001 as an Office of 

Management and Budget e-government project to establish federal health information 

standards to enable federal agencies to build interoperable health data systems. The 

project was incorporated into the Federal Health Architecture in September 2004. 

22 Federal Information Processing Standards are developed by NIST in collaboration with 

national and international standards committees, users, industry groups, consortia, and 

research and trade organizations when there are no existing voluntary industry standards

to address federal requirements for the interoperability of different systems, for the

portability of data and software, and for computer security. 

Page 12 GAO-06-1071T 
HHS Has Begun to Define Requirements for the Development of Prototypes for the 

Nationwide Health Information Network 

HHS’s Nationwide Health Information Network contracts are 

intended to provide architectures and prototypes of national 

networks based on the breakthrough areas defined by the American 

Health Information Community. HHS awarded contracts for 

developing these architectures and prototypes to four contractors. 

The contractors are to deliver final operating plans and prototypes 

of a national network that demonstrates health information 

exchange across multiple markets in November 2006. 

In late June 2006, HHS held its first Nationwide Health Information

Network forum. More than 1000 functional requirements for a 

Nationwide Health Information Network were presented for 

discussion and public input. The requirements addressed general 

Nationwide Health Information Network infrastructure needs and 

the breakthrough areas defined by the American Health Information 

Community. The requirements are being reviewed by the National 

Committee for Vital and Health Statistics,23 which is expected to 

release its approved requirements by September 2006. 

HHS Is Taking Steps to Incorporate Privacy and Security Policies, Practices, and 

Standards into Its National Strategy 

HHS, through its contracts and recommendations from the 

American Health Information Community and the National 

Committee for Vital and Health Statistics, has initiated several 

actions to address privacy and security issues associated with the 

nationwide exchange of health information. In May 2006, 22 states 

subcontracted under HHS’s privacy and security contract to perform 

assessments of the impact of organization-level business policies 

and state laws on security and privacy practices and the degree to 

which they pose challenges to interoperable health information 

exchange. In August 2006, 11 more states and Puerto Rico were 

 23 The National Committee on Vital and Health Statistics was established in 1949 as a public 

advisory committee that is statutorily authorized to advise the Secretary of HHS on health

data, statistics, and national health information policy, including the implementation of 

health IT standards. 

Page 13 GAO-06-1071T 
added to the scope of the contract. The outcomes of the contract are 

to provide a nationwide synthesis of information to inform privacy 

and security policy making at federal, state, and local levels. 

In addition, the standards selected through the standards 

harmonization contract include those that are applicable to the 

consumer empowerment breakthrough area, specifically privacy 

and confidentiality. Its initial standards are intended to allow 

consumers the ability to establish and manage permissions and 

access rights, along with informed consent for authorized and 

secure exchange, viewing, and querying of their medical information 

between designated caregivers and other health professionals. 

Additionally, the proposed functional requirements for the 

Nationwide Health Information Network include security 

requirements that are needed for ensuring the privacy and 

confidentiality of health information. 

In May 2006, several of the American Health Information 

Community workgroups recommended the formation of an 

additional workgroup comprised of privacy, security, clinical, and 

technology experts from each of the other American Health 

Information Community workgroups. The Confidentiality, Privacy, 

and Security Workgroup was formed in July to frame the privacy 

and security policy issues relevant to all breakthrough areas and 

solicit broad public input to identify viable options or processes to 

address these issues. The recommendations developed by this 

workgroup are intended to establish an initial policy framework and 

address issues including methods of patient identification, methods 

of authentication, mechanisms to ensure data integrity, methods for 

controlling access to personal health information, policies for 

breaches of personal health information confidentiality, guidelines 

and processes to determine appropriate secondary uses of data, and 

a scope of work for a long-term independent advisory body on 

privacy and security policies. The workgroup convened last month. 

In June 2006, the National Committee on Vital and Health Statistics 

presented to the Secretary of HHS a report recommending actions 

regarding privacy and confidentiality in the Nationwide Health 

Information Network. The recommendations cover topics that are, 

according to the committee, central to challenges for protecting 

Page 14 GAO-06-1071T 
health information privacy in a national health information 

exchange environment. Specifically, they address (1) the role of 

individuals in making decisions about the use of their personal 

health information, (2) policies for controlling disclosures across a 

national health information network, (3) regulatory issues such as 

jurisdiction and enforcement, (4) use of information by non-health 

care entities, and (5) establishing and maintaining the public trust 

that is needed to ensure the success of a national health information 

network. The recommendations are being evaluated by the 

American Health Information Community workgroups, the 

Certification Commission for Health IT, Health Information 

Technology Standards Panel, and other HHS partners. The 

committee intends to continue to update and refine its 

recommendations as the architecture and requirements of the 

network advance. 

HHS Is Continuing to Address Public Health Integration 

To help promote the integration of public health data into a 

nationwide health information exchange, the American Health 

Information Community’s biosurveillance workgroup made 

recommendations in May 2006 intended to help the simultaneous 

flow of clinical care data to and among local, state, and federal 

biosurveillance programs. The community recommended that HHS 

develop sample data-use agreements and implementation guidance

to facilitate the sharing of data from health care providers to public 

health agencies. The workgroup also recommended that HHS, in 

collaboration with privacy experts, state and local governmental 

public health agencies, and clinical care partners, develop materials 

to educate the public about the information that is used for 

biosurveillance including the benefits to the public’s health, 

improved national security, and the protection of patient 

confidentiality by September 30, 2006. 

Information exchange standards for sharing clinical health 

information (e.g., emergency department visit data and lab results) 

with public health are included in the 90 standards recently 

recommended as a result of HHS’s standards harmonization 

contract. The standards are intended to enable the transmission of 

essential ambulatory care and emergency department visit, 

Page 15 GAO-06-1071T 
utilization, and lab result data from electronic health care delivery 

and public health systems in standardized and anonymized24 format 

to authorized public health agencies within less than one day. In 

addition to advancing the use of electronic health records, the Gulf 

Coast contract is intended to help support public health emergency 

response by fostering the availability of field-level electronic health 

records to clinicians responding to disasters. 

HHS Is Continuing Efforts to Complete and Implement a National Strategy for Health IT 

As called for by the President’s executive order in April 2004, the 

national coordinator’s office is continuing its efforts to complete a 

national strategy for health IT. Since we testified in March 2006, the 

office has worked to evolve the initial framework and, with 

guidance from the American Health Information Community, has 

revised and refined the goals and strategies identified in the initial 

framework. The new draft framework—The Office of the National 

Coordinator: Goals, Objectives, and Strategies—provides high-level 

strategies for meeting the President’s goal for the adoption of 

interoperable health IT and is to be used to develop internal 

performance measures for the office’s activities. 

The framework identifies objectives for accomplishing each of four 

goals, along with 32 high-level strategies for meeting the objectives. 

The Office of the National Coordinator has identified and prioritized 

the 32 strategies for accomplishing the framework’s goals and has 

initiated 10 of them, which are supported by the contracts that HHS 

awarded in fall 2005. Table 3 illustrates the framework’s goals, 

objectives, and strategies and identifies the 10 strategies that have 

been initiated. 

The Office of the National Coordinator has prioritized the remaining 

22 strategies defined in its framework. Six strategies are under 

active consideration, and the remaining 16 require future discussion. 

According to officials with the office, the strategies were prioritized 

based on guidance and direction from the American Health 

Information Community. The Office of the National Coordinator 

 24 Anonymized data are data that have had personally identifying information removed. 

Page 16 GAO-06-1071T 
expects the framework to continue to evolve through collaboration 

among the Office of the National Coordinator and its partners, such 

as other federal agencies and the American Health Information 

Community, and as additional activities are completed through the 

contracts. 

Table 3: Office of the National Coordinator’s Goals and Initial Objectives and Strategies 

Goals Objectives High-level strategies

Simplify health information access and communication among cliniciansa High-value electronic health 

records Increase incentives for clinicians to use electronic health recordsc 

Foster economic collaboration for electronic health records adoptionb 

Lower total cost of electronic health records purchase and implementationb

Low-cost and low-risk electronic 

health records

Lower risk of electronic health records adoption

a

Increase investment in sources of evidence-based knowledge

c 

Increase investment in tools that can access and integrate evidence based 

knowledge in the clinical settingc 

Current clinical knowledge 

Establish mechanisms which will allow clinicians to empirically access 

information and other patient characteristics that can better inform their 

clinical decisionsc 

Ensure low-cost electronic health records for clinicians in underserved 

areasc 

Goal 1: Inform health care 

professionals 

Equitable adoption of electronic

health records

Support adoption and implementation by disadvantaged providersc 

Establish well-defined health information standardsa 

Ensure federal agency compliance with health information standardsa 

Widespread adoption of 

standards 

Exercise federal leadership in health information standards adoptiona 

Stimulate private investment to develop the capability for efficient sharing of

health informationb

Use government payers and purchasers to foster interoperable electronic 

health information exchangec 

Adapt federal agency health data collection and delivery to NHIN solutionsc 

Sustainable electronic health 

information exchange 

Support state and local governments and organizations to foster electronic 

health information exchangeb

Support the development and implementation of appropriate privacy and 

security policies, practices, and standards for electronic health information

exchangea 

Goal 2: Interconnect health 

care 

Consumer privacy and risk 

protections 

Develop and support policies to protect against discrimination from health 

information

c 

Establish value of personal health records, including consumer trustbConsumer use of personal 

health information Expand access to personal health management information and toolsa 

Remote monitoring and 

communications

Promote adoption of remote monitoring technology for communication 

between providers and patients

a 

Goal 3: Personalize health 

management 

Care based on culture and traits Promote consumer understanding and provider use of personal genomics 

for prevention and treatment of hereditary conditionsc 

Page 17 GAO-06-1071T 
Goals Objectives High-level strategies

Promote multi-cultural information supportc

Enable simultaneous flow of clinical care data to and among local, state, 

and federal biosurveillance programsa Automated public health and safety monitoring and 

management Ensure that the nationwide health information network supports population

health reporting and managementc

Develop patient-centric quality measures based on clinically relevant 

information available from interoperable longitudinal electronic health 

recordsb

Ensure adoption of uniform performance measures by health care 

stakeholdersc

Efficient collection of quality 

information

Establish standardized approach to centralized electronic data capture and 

reporting of performance informationc

Transformation of clinical 

research 

Foster the availability of field electronic health records to clinicians 

responding to disastersa

Improve coordination of health information flow during disasters and crises

c

Goal 4: Improve population 

health 

Health information support in 

disasters and crises 

Support management of health emergencies

c

Source: HHS Office of the National Coordinator for Health IT 

a

 Strategy has been initiated 

b

 Strategy is under active consideration 

c

 Strategy requires future discussion 

While HHS has taken additional steps toward completing a national 

strategy and has initiated specific activities defined by its strategic 

framework, it still lacks the detailed plans, milestones, and 

performance measures needed to ensure that its goals are met. 

While the National Coordinator acknowledged the need for more 

detailed plans for its various initiatives and told us in March that 

HHS intended to release a strategic plan with detailed plans and 

milestones later this year, current officials with the office could not 

tell us when detailed plans and milestones would be defined. Given 

the complexity of the tasks at hand and the many activities to be 

completed, a national strategy that defines detailed plans,

milestones, and performance measures is essential. Without it, HHS 

risks not meeting the President’s goal for health IT. 

In summary, Mr. Chairman, our work shows that HHS is continuing 

its efforts to help transform the use of IT in the health care industry. 

However, much work remains. While HHS, through the Office of the 

National Coordinator for Health IT and the American Health 

Information Community, has initiated specific actions for 

Page 18 GAO-06-1071T 
supporting the goals of a national strategy, detailed plans and 

milestones for completing the various initiatives and performance 

measures for tracking progress have not been developed. Until these 

plans, milestones, and performance measures are completed, it 

remains unclear specifically how the President’s goal will be met 

and what the interim expectations are for achieving widespread 

adoption of interoperable electronic health records by 2014. 

Mr. Chairman, this concludes my statement. I would be pleased to 

answer any questions that you or other Members of the 

Subcommittee may have at this time. 

Page 19 GAO-06-1071T 
Contacts and Acknowledgments 

If you should have any questions about this statement, please 

contact me at (202) 512-9286 or by e-mail at pownerd@gao.gov. 

Other individuals who made key contributions to this statement are 

Amanda C. Gill, Nancy E. Glover, M. Saad Khan, and Teresa F. 

Tucker. 

Page 20 GAO-06-1071T 310822 
Abbreviations 

HHS Department of Health and Human Services 

IT information technology 

NIST National Institute for Standards and Technology 

This is a work of the U.S. government and is not subject to copyright protection in the

United States. It may be reproduced and distributed in its entirety without further

permission from GAO. However, because this work may contain copyrighted images or

other material, permission from the copyright holder may be necessary if you wish to

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER