ELECTRONIC 

HEALTH RECORDS

HHS Strategy to 

Address Information 

Exchange Challenges 

Lacks Specific 

Prioritized Actions 

and Milestones

Report to Congressional Committees

March 2014

GAO-14-242

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-14-242, a report to 

congressional committees

March 2014

ELECTRONIC HEALTH RECORDS

HHS Strategy to Address Information Exchange 

Challenges Lacks Specific Prioritized Actions and 

Milestones

Why GAO Did This Study

The Health Information Technology for 

Economic and Clinical Health Act 

(HITECH) promotes the use of health 

information technology and identifies 

the importance of health information 

exchange. It provides incentive 

payments to promote the widespread 

adoption and meaningful use of EHR 

technology. To be a meaningful user, 

providers are to demonstrate, among 

other things, that their certified EHR 

technology can electronically exchange 

health information. GAO examined 

(1) the key challenges to the electronic 

exchange of health information, if any, 

that have been reported by providers 

and stakeholders, and HHS’s ongoing 

efforts to address them, and (2) the 

extent to which HHS has planned 

future actions to address those key 

challenges. GAO reviewed HHS 

documentation; interviewed HHS 

officials; and interviewed providers—

hospital officials and physicians—and 

relevant stakeholders about their 

experiences.

What GAO Recommends

GAO recommends that CMS and ONC 

(1) develop and prioritize specific 

actions that HHS will take consistent 

with the principles in HHS’s strategy to 

advance health information exchange, 

and (2) develop milestones with time 

frames for the actions to better gauge 

progress toward advancing exchange, 

with appropriate adjustments over 

time. In commenting on the draft 

report, HHS, including CMS and ONC, 

concurred with these 

recommendations.

What GAO Found

Providers and stakeholders GAO interviewed in four states with ongoing 

electronic health information exchange efforts cited key challenges to exchange, 

in particular, issues related to insufficient standards, concerns about how privacy 

rules can vary among states, difficulties in matching patients to their records, and 

costs associated with exchange. Officials from the Centers for Medicare & 

Medicaid Services (CMS) and the Office of the National Coordinator for Health 

Information Technology (ONC)—agencies within the Department of Health and 

Human Services (HHS)—noted that they have several ongoing programs and 

initiatives to help address some aspects of these key challenges, but concerns in 

these areas continue to exist. For example, several providers GAO interviewed 

said that they have difficulty exchanging certain types of health information due 

to insufficient health data standards. Although HHS has begun to address 

insufficiencies in standards through its Medicare and Medicaid Electronic Health 

Record (EHR) programs, such as through the introduction of new 2014 standards 

for certified EHR technology, it is unclear whether its efforts will lead to 

widespread improvements in electronic health information exchange. In addition, 

providers GAO interviewed reported challenges covering costs associated with 

electronic exchange, such as upfront costs associated with purchasing and 

implementing EHR systems. While HHS is working to address this challenge 

through various efforts, including a program that helps fund health information 

exchange organizations—organizations that provide support to facilitate the 

electronic exchange of health information—some providers told GAO they do not 

participate in these organizations because they see limited opportunities for 

exchanging information through them.

HHS, including CMS and ONC, developed and issued a strategy document in 

August 2013 that describes how it expects to advance electronic health 

information exchange. The strategy identifies principles intended to guide future 

actions to address the key challenges that providers and stakeholders have 

identified. However, the HHS strategy does not specify any such actions, how 

any actions should be prioritized, what milestones the actions need to achieve, or 

when these milestones need to be accomplished. GAO’s prior work, consistent 

with the Government Performance and Results Act Modernization Act of 2010 

(GPRAMA), sets forth several key elements of strategies that can guide agencies 

in planning and implementing an effective government program. As noted in 

GAO’s prior work, elements such as specific actions, priorities, and milestones 

are desirable for evaluating progress, achieving results in specified time frames, 

and ensuring effective oversight and accountability. Determining specific actions 

and exchange-related milestones with specified time frames can help to ensure 

that the agencies’ principles and future actions result in timely improvements in 

addressing the key challenges reported by providers and stakeholders; this is 

particularly important because planning for Stage 3 of the EHR programs, which 

focuses on improving outcomes, is expected to begin as soon as 2014. This 

information could also help CMS and ONC prioritize their future actions based on 

whether health information is being exchanged effectively among providers, in 

order to better achieve the EHR programs’ ultimate goals of improving quality, 

efficiency, and patient safety.

View GAO-14-242. For more information, 

contact Linda T. Kohn at (202) 512-7114 or 

kohnl@gao.gov.
Page i GAO-14-242 Electronic Health Record Information Exchange

Letter 1 

Background 6

Challenges Are Reported Related to Standards, Privacy, Patient 

Matching, and Costs of Electronic Exchange 10

HHS Developed an Electronic Health Information Exchange 

Strategy That Includes Principles to Address Key Challenges 

but Lacks Specific Prioritized Actions and Milestones 19

Conclusions 21

Recommendations for Executive Action 22

Agency Comments 22

Appendix I Information Reported by Providers on the Electronic Exchange 

of Health Information and Its Related Benefits 26

Appendix II Stage 1 and Stage 2 Meaningful Use Measures Related to Electronic 

Health Information Exchange 30

Appendix III CMS and ONC Principles to Facilitate Health Information Exchange 34

Appendix IV Comments from the Department of Health and Human Services 36

Appendix V GAO Contact and Staff Acknowledgments 39

Tables

Table 1: Meaningful Use Measures Related to Electronic Health 

Information Exchange According to the Centers for 

Medicare & Medicaid Services (CMS) and the Office of 

the National Coordinator for Health Information 

Technology (ONC), Stage 1 and Stage 2 31

Table 2: The Centers for Medicare & Medicaid Services (CMS) 

and the Office of the National Coordinator for Health 

Information Technology (ONC) Principles Related to 

Health Information Exchange 35

Contents
Page ii GAO-14-242 Electronic Health Record Information Exchange

Figure

Figure 1: Examples of Health Information Exchange Using 

Electronic Health Record Technology 7

Abbreviations

ACO accountable care organization

AHA American Hospital Association

CCD continuity of care document

CHIME College of Healthcare Information Management 

 Executives

CMS Centers for Medicare & Medicaid Services 

EHR electronic health record

GPRA Government Performance and Results Act

GPRAMA GPRA Modernization Act

HHS Department of Health and Human Services

HIE organization health information exchange organization

HIPAA Health Insurance Portability and Accountability Act

HIT health information technology

HITECH Health Information Technology for Economic and 

 Clinical Health Act

ONC Office of the National Coordinator for Health 

 Information Technology

REC regional extension center

Recovery Act American Recovery and Reinvestment Act of 2009 

RFI request for information 

SNOMED CT Systematized Nomenclature of Medicine Clinical 

 Terms

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-14-242 Electronic Health Record Information Exchange

441 G St. N.W.

Washington, DC 20548

March 24, 2014

Congressional Committees

The use of health information technology (HIT), such as electronic health 

record (EHR) systems, has the potential to allow health care providers 

and others to exchange health care information electronically, which is a 

key way that this technology could lead to improved health care quality 

and reduced costs. Health information exchange is especially important 

because the health care system is highly fragmented, with care and 

services provided in multiple settings, such as physician offices and 

hospitals, that may not be coordinated with each other.1 Because of this 

fragmentation, providers may lack ready access to critical information 

needed to, for example, coordinate the care of patients to ensure they 

make the most-informed decisions on treatment options. Lack of care 

coordination can lead to inappropriate or duplicative tests and procedures 

that increase health care spending. Estimates of this spending increase 

range from $148 billion to $226 billion per year.2

To deliver coordinated care, a physician and other members of the care 

team must access and share health information from multiple settings. 

Providers may share clinical data using manual methods such as faxing 

paper records, but these methods can be time consuming and costly and 

are often unavailable at the point of care. In addition, data shared via 

manual methods are generally not structured or captured electronically to 

be stored in EHRs. Lacking the ability to receive and store structured data 

in their systems, providers may not be able to easily search for the 

information they need or electronically transmit the information effectively 

to another EHR without manual efforts. Electronic health information 

exchange has the potential to bring patient information directly from an 

EHR to the provider delivering care, regardless of where the care or 

 

1

We use the term health information exchange to refer to the sharing of health information 

among organizations. The term is also used elsewhere to refer to a stakeholder 

organization that provides services to enable the electronic sharing of health-related 

information among providers and other entities, such as public health departments; we 

refer to such an organization as a health information exchange organization (HIE 

organization).

2

D. Berwick and A. Hackbarth, “Eliminating Waste in U.S. Health Care,” Journal of the 

American Medical Association, vol. 307, no. 14 (2012).
 

Page 2 GAO-14-242 Electronic Health Record Information Exchange

services are delivered. Electronically exchanging information can facilitate 

care coordination and improve communication among providers, staff, 

and patients by making patient clinical information more readily available 

to providers. Electronically exchanging information is also important in 

new delivery system and payment models, such as accountable care 

organizations (ACO), because of the need for providers in different 

settings to have ready access to information needed to manage and 

coordinate care.3

The Health Information Technology for Economic and Clinical Health Act 

(HITECH), enacted as part of the American Recovery and Reinvestment 

Act of 2009 (Recovery Act), provided funding for various activities 

intended to promote the adoption and meaningful use of certified EHR 

technology.4 HITECH identified the importance of the electronic exchange 

of health information by requiring it as a key element in the definition of 

meaningful use of certified EHR technology.5

 

3

An ACO is a group of providers and suppliers of services, such as hospitals and 

physicians, that work together to coordinate care for the patients they serve.

Specifically, in order to be a 

meaningful EHR user, providers are to demonstrate that their certified 

EHR technology is able to electronically exchange health information to 

improve the quality of health care, such as by promoting care 

coordination. As such, electronic exchange is of key importance to the 

Department of Health and Human Services’ (HHS) Medicare and 

Medicaid EHR programs, which are intended to help increase the 

4

HITECH was enacted as title XIII of division A and title IV of division B of the Recovery 

Act. Pub. L. No. 111-5, div. A, tit. XIII, 123 Stat. 115, 226-279 and div. B, tit. IV, 123 Stat. 

115, 467-496 (2009).

To be certified, EHR technology must meet certain criteria established by HHS’s Office of 

the National Coordinator for Health Information Technology that describe minimum related 

performance standards and implementation specifications. Certified EHR technology 

helps assure purchasers and other users that an EHR offers a minimum level of 

technological capability, functionality, and security.

5

HITECH defined a meaningful EHR user as one who, in addition to using certified 

technology to electronically exchange health information, demonstrates to the satisfaction 

of the Secretary of Health and Human Services that (1) the technology is certified and 

being used in a meaningful manner, and (2) the certified technology is used to submit 

information on clinical quality measures and other measures in a form and manner 

specified by the Secretary. See Pub. L. No. 111-5, § 4101(a), 123 Stat. 467-472.
 

Page 3 GAO-14-242 Electronic Health Record Information Exchange

meaningful use of EHR technology and which are estimated to include 

total spending of $30 billion from 2011 through 2019.6

Research suggests that despite substantial growth in EHR adoption, 

electronic exchanges between providers have remained limited.7 HITECH 

requires us to report on, among other things, its effect on the adoption of 

EHRs by providers.8 We issued five reports on the EHR programs’ 

implementation.9

To examine the key challenges to the electronic exchange of health 

information, if any, reported by providers and stakeholders, and HHS’s 

For example, in March 2014, we reported on the extent 

to which providers have met measures of meaningful use, including 

measures that involved the electronic exchange of health information, and 

noted that providers may face challenges meeting some of these 

measures under the EHR programs. As discussed with the committees of 

jurisdiction, this report addresses the electronic exchange of health 

information and serves as one of the series of reports we conducted to 

respond to the mandate. Specifically, this report examines (1) the key 

challenges to the electronic exchange of health information, if any, that 

have been reported by providers and stakeholders, and HHS’s ongoing 

efforts to address these challenges, and (2) the extent to which HHS has 

planned future actions to address the key challenges, if any, reported by 

providers and stakeholders.

 

6

Congressional Budget Office, “Health Information Technology for Economic and Clinical 

Health Act” (Washington, D.C.: Jan. 21, 2009). 

7

C. DesRoches et al., “Adoption of Electronic Health Records Grows Rapidly, but Fewer 

Than Half of US Hospitals Had at Least a Basic System in 2012,” Health Affairs, vol. 32, 

no. 8 (2013); and M. Furukawa et al., “Hospital Electronic Health Information Exchange 

Grew Substantially In 2008-12,” Health Affairs, vol. 32, no. 8 (2013).

8

See Pub. L. No. 111-5, § 13424(e), 123 Stat. 278-279.

9

GAO, Electronic Health Records: First Year of CMS’s Incentive Programs Shows 

Opportunities to Improve Processes to Verify Providers Met Requirements, GAO-12-481

(Washington, D.C.: Apr. 30, 2012); Electronic Health Records: Number and 

Characteristics of Providers Awarded Medicare Incentive Payments for 2011, 

GAO-12-778R (Washington, D.C.: July 26, 2012); Electronic Health Records: Number and 

Characteristics of Providers Awarded Medicaid Incentive Payments for 2011, 

GAO-13-146R (Washington, D.C.: Dec. 13, 2012); Electronic Health Records: Number 

and Characteristics of Providers Awarded Medicare Incentive Payments for 2011-2012,

GAO-14-21R (Washington, D.C.: Oct. 24, 2013); and Electronic Health Record Programs: 

Participation Has Increased, but Action Needed to Achieve Goals, Including Improved 

Quality of Care, GAO-14-207 (Washington, D.C.: Mar. 6, 2014).
 

Page 4 GAO-14-242 Electronic Health Record Information Exchange

ongoing efforts to address these challenges, we selected four states—

Georgia, North Carolina, Minnesota, and Massachusetts—in which to 

interview selected providers and other relevant stakeholders to learn 

about the exchange of health information within their respective states.10

We initially interviewed selected providers in Georgia, and then selected 

the additional states of North Carolina, Minnesota, and Massachusetts 

because they were mentioned during interviews with stakeholders and 

officials from HHS as having ongoing efforts related to health information 

exchange.11 These three states also had an existing Pioneer ACO or a 

Beacon Community in which providers were likely to have some 

experience attempting to electronically exchange health information.12 In 

each of the four selected states, we asked officials from the Regional 

Extension Centers (REC) and health information exchange organizations 

(HIE organization) to tell us about the exchange activities occurring in 

their state and to help us identify providers—individual physicians, 

hospitals, and health systems—to learn about their efforts to exchange 

health information.13

 

10In this report the term stakeholders generally refers to officials we spoke with from 

professional associations, such as the American Medical Association, or officials from 

regional extension centers (REC), HIE organizations, or state public health departments.

We also conducted interviews with other relevant 

stakeholders that include the American Hospital Association (AHA), the 

American Medical Association, the College of Healthcare Information 

RECs are organizations funded by the Office of the National Coordinator for Health 

Information Technology (ONC) to assist providers in the adoption, implementation, and 

meaningful use of EHRs. HITECH established the REC program, which awarded 

approximately $721 million in grants to create these centers. Similarly, ONC has awarded 

$564 million through its State Health Information Exchange Cooperative Agreement 

Program to states and territories to develop and advance resources to facilitate the 

exchange of health information among health care providers.

11We selected Georgia as a pilot state to test our provider interview protocol. Because the 

interviews in Georgia did not result in significant changes to our interview protocol, we 

used the results from our Georgia interviews in addition to the results from the three states 

we subsequently selected.

12The Pioneer ACO program model is an effort by the Centers for Medicare & Medicaid 

Services (CMS) designed to support organizations that have experience operating as 

ACOs in which coordinated care is delivered to beneficiaries at a lower cost to Medicare.

The Beacon Community Program consists of 17 communities throughout the country that 

have received funding from ONC in an effort to demonstrate how HIT investments and 

meaningful use of EHRs can advance the vision of patient-centered care.

13A health system is an organization of people, institutions, and resources that delivers 

health care services.
 

Page 5 GAO-14-242 Electronic Health Record Information Exchange

Management Executives (CHIME), and two commonly used EHR vendors 

for providers that attested to meaningful use in 2012. We conducted a 

total of 30 interviews with providers and stakeholders. Findings based on 

these interviews cannot be generalized to all providers.

In addition to interviewing providers and stakeholders about electronic 

exchange and the challenges of such exchange, we also reviewed 

additional sources to supplement our interviews, such as published 

literature and written information provided from stakeholders such as 

CHIME and AHA, including their responses to HHS’s March 2013 request 

for information (RFI) about interoperability and health information 

exchange.14

To examine the extent to which HHS has planned future actions to 

address the key challenges, if any, reported by providers and 

stakeholders, we interviewed officials from CMS and ONC who are 

responsible for overseeing and managing the EHR programs and other 

relevant programs and initiatives related to health information exchange. 

We asked them about the key challenges reported to us by the providers 

and stakeholders we interviewed as well as key challenges we identified 

from documents. We also reviewed documents related to ongoing and 

future HHS health information exchange actions, including strategy 

documents, policies, and presentations. In addition, we reviewed relevant 

requirements in our previous work on the elements of an effective 

strategy,

To provide context for the challenges reported by providers 

and stakeholders and to identify HHS’s ongoing efforts to address them, 

we interviewed officials from the Centers for Medicare & Medicaid 

Services (CMS) and the Office of the National Coordinator for Health 

Information Technology (ONC) and reviewed documents related to 

current HHS efforts on health information exchange.

15 which is consistent with the Government Performance and 

Results Act (GPRA) of 1993,16

 

1478 Fed. Reg. 14793 (March 7, 2013). CMS and ONC—both within HHS—released an 

RFI to seek input on a series of potential policy and programmatic changes to accelerate 

electronic health information exchange across providers, as well as new ideas that would 

be both effective and feasible to implement.

as amended by the GPRA Modernization 

Interoperability is the ability of two or more systems or components to exchange 

information and to use the information that has been exchanged.

15GAO, Combating Terrorism: Evaluation of Selected Characteristics in National 

Strategies Related to Terrorism, GAO-04-408T (Washington, D.C.: Feb. 3, 2004).

16Pub. L. No. 103-62, 107 Stat. 285 (1993).
 

Page 6 GAO-14-242 Electronic Health Record Information Exchange

Act (GPRAMA) of 2010.17

We conducted this performance audit from February 2013 through March 

2014 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

We compared HHS’s documentation that 

delineates its planned steps for health information exchange to these 

requirements.

Approaches to electronic health information exchange have expanded in 

recent years with the increased adoption of EHRs and growth of HIE 

organizations. For example, some providers can electronically exchange 

clinical information via interoperable EHR systems. In cases in which 

providers wish to exchange electronic health information but do not have 

interoperable systems, HIE organizations can serve as key facilitators of 

exchange by providing for data connections among stakeholders, 

including laboratories, public health departments, hospitals, and 

physicians. Specifically, the use of EHR technology and the use of HIE 

organizations can allow providers to request and receive information 

about patients from other providers’ records, such as medication lists, 

laboratory results, or previous diagnoses and hospitalizations. For 

example, when a provider requests information, the HIE organization may 

be able to identify the sources of the requested data and initiate the 

electronic transmission that delivers the data from another provider’s EHR 

in a format that can be accepted and processed by the receiving 

provider’s EHR. Examples of exchange activities that can occur using 

EHR technology directly between providers or through an HIE 

organization are shown in figure 1.

 

17Pub. L. No. 111-352, 124 Stat. 3866 (2011).

Background

Electronic Health 

Information Exchange
 

Page 7 GAO-14-242 Electronic Health Record Information Exchange

Figure 1: Examples of Health Information Exchange Using Electronic Health Record Technology

According to an April 2012 article, exchanging EHR information with other 

entities can be significantly more difficult for a provider than using EHRs 

to manage health information within the provider’s organization only—

without exchanging the information with others.18

 

18J. Adler-Milstein and A. Jha, “Sharing Clinical Data Electronically: A Critical Challenge 

for Fixing the Health Care System,” Journal of the American Medical Association, vol. 307, 

no. 16 (2012).

Appendix I provides 
 

Page 8 GAO-14-242 Electronic Health Record Information Exchange

information about the extent to which providers are able to electronically 

exchange health information, as reported by providers and stakeholders 

we interviewed.

HITECH provided funding for various activities, including the Medicare 

and Medicaid EHR programs. These programs are intended to help 

increase the meaningful use of EHR technology by providing incentive 

payments for, and later imposing penalties on, providers—that is, certain 

hospitals and health care professionals such as physicians—who 

participate in Medicare or Medicaid.19 These programs are the largest of 

the activities, in terms of potential federal expenditures, funded by 

HITECH. Within HHS, CMS and ONC have developed the programs’ 

requirements.20

CMS is responsible for administering the Medicare EHR program and 

overseeing and funding most of the Medicaid EHR program, which is 

administered by the states and U.S. insular areas.21

 

19See Pub. L. No. 111-5, § 4101(a)-(b), 123 Stat. 467-473. In 2015 the Medicare EHR 

program is to begin applying a payment adjustment, referred to in this report as a penalty, 

for hospitals and professionals that do not meet the Medicare EHR program requirements. 

The Medicaid EHR program does not impose penalties on Medicaid providers that do not 

meet the Medicaid EHR program’s requirements by a specific date; however, if Medicaid 

providers also treat Medicare patients, they are required to meet the Medicare EHR 

program’s requirements from 2015 onward to avoid penalties from the Medicare EHR 

program. 

For both EHR 

programs, CMS established specific requirements under three 

progressive stages of meaningful use that providers must meet to qualify 

20See Medicare and Medicaid Programs: Electronic Health Record Incentive Program, 

75 Fed. Reg. 44314 (July 28, 2010), codified at 42 C.F.R. pts. 412, 413, 422 and 495; 

Health Information Technology: Initial Set of Standards, Implementation Specifications, 

and Certification Criteria for Electronic Health Records Technology, 75 Fed. Reg. 44590 

(July 28, 2010), codified at 45 C.F.R. pt. 170; Medicare and Medicaid Programs; 

Electronic Health Record Incentive Program—Stage 2, 77 Fed. Reg. 53968 (Sept. 4, 

2012), codified at 42 C.F.R. pts. 412, 413 and 495; and Health Information Technology: 

Standards, Implementation Specifications, and Certification Criteria for Electronic Health 

Records Technology, 2014 Edition, 77 Fed. Reg. 54163 (Sept. 4, 2012), codified at 

45 C.F.R. pt. 170. 

21CMS provides states with 100 percent of the cost of incentive payments made to 

Medicaid providers and 90 percent of the costs related to reasonable administrative 

expenses and planning activities related to the Medicaid EHR program. 42 U.S.C. 

§ 1396b(a)(3)(F)(i) and (ii). 

Medicare and Medicaid 

EHR Programs
 

Page 9 GAO-14-242 Electronic Health Record Information Exchange

for incentive payments.22

• Stage 1, which began in 2011, set the basic functionalities EHRs must 

include, such as capturing data electronically and providing patients 

with electronic copies of health information.

As the programs progress through these stages, 

more requirements will be added:

23

• Stage 2, which began in 2014, added requirements such as increased 

health information exchange between providers to improve care 

coordination for patients. For example, Stage 2 will require hospitals 

and professionals to provide an electronic summary of care document 

for each transition of care or referral to another provider, whereas in 

Stage 1 this measure was optional.

CMS and ONC 

indicated that Stage 1 allowed providers to test the capability of their 

EHRs to electronically exchange health information.

24

• Stage 3, which is scheduled to go into effect in 2017, will continue to 

expand on meaningful use to improve health care outcomes and the 

exchange of health information, according to CMS and ONC. The 

requirements for this stage have not yet been developed.

ONC is responsible for identifying health data standards and technical 

specifications for EHR technology and establishing and overseeing the 

certification of EHR technology.25

 

22Providers can receive incentive payments from the Medicaid EHR program in their first 

year of participation by reporting that they adopted, implemented, or upgraded to certified 

EHR technology rather than demonstrating meaningful use. In subsequent years, though, 

they must demonstrate meaningful use to receive incentive payments.

As part of the EHR programs, providers 

23References in this report to a year in the EHR programs conform to the concept of 

program year, which for hospitals is based on the fiscal year and for professionals is 

based on the calendar year. For example, for hospitals, the 2011 program year was from 

October 1, 2010, to September 30, 2011, whereas for professionals, the 2011 program 

year was from January 1, 2011, to December 31, 2011.

24Professionals do not have to satisfy this requirement if they make fewer than 100 patient 

transfers to another setting of care or referrals to another provider during the reporting 

period for the EHR programs.

25In general, EHR technology is not required to be certified by ONC. However, to receive 

EHR program incentive payments, providers must use certified EHR technology.

Health data standards are used to facilitate health information exchange and 

interoperability. Such standards consist of languages and technical specifications that, 

when adopted by multiple entities, facilitate the exchange of health information. Health 

data standards include, for example, standardized language for prescriptions and for 

laboratory testing. 
 

Page 10 GAO-14-242 Electronic Health Record Information Exchange

must report annually on certain mandatory meaningful use measures and 

on additional measures that they may choose from a menu of measures. 

Appendix II describes those Stage 1 and Stage 2 meaningful use 

measures that CMS and ONC reported as specifically relating to health 

information exchange.

Providers and stakeholders we interviewed cited key challenges to 

electronic health information exchange; in particular, they cited issues 

related to insufficient standards, concerns about how privacy rules can 

vary among states, difficulties in matching patients to their records, and 

costs associated with electronic health information exchange. CMS and 

ONC officials noted that they have several ongoing programs and 

initiatives to help address some aspects of these key challenges, but 

concerns in these areas continue to exist.

Reported insufficiencies in standards for electronic health 

information exchange. While standards for electronically exchanging 

information within the EHR programs exist, providers reported that 

standards may not be sufficient in some areas. Information that is 

electronically exchanged from one provider to another must adhere to the 

same standards in order to be interpreted and used in EHRs, thereby 

permitting interoperability. Several providers stated that they often have 

difficulty exchanging certain types of health information with other 

providers that have a different EHR system due to a lack of sufficient 

standards to support exchange.

One area for which providers told us standards were insufficient relates to 

standards for allergies. Specifically, one provider noted that there are not 

sufficient standards to define allergic reactions, and another provider 

explained that some EHR systems classify an allergic reaction as a side 

effect, while other EHR systems classify the same reaction as an allergy. 

Such differences can cause confusion when health information is 

exchanged among providers because providers who receive information 

may have difficulty locating or using information on allergies if their EHR 

systems classify the information differently than the EHR systems of the 

providers who sent the information. Similarly, an article from the Journal 

of the American Medical Informatics Association stated that the proper 

Challenges Are 

Reported Related to 

Standards, Privacy, 

Patient Matching, and 

Costs of Electronic 

Exchange
 

Page 11 GAO-14-242 Electronic Health Record Information Exchange

terminology for encoding patients’ allergies is complex and that some 

gaps still exist across existing standards.26

HHS has begun to address insufficiencies in standards through the EHR 

programs. In order to participate in the programs, providers must use 

EHR technology that has been certified by HHS to meet certain criteria. 

Specifically, the standards and certification criteria identify certain 

vocabularies and structured formats that must be included in certified 

EHR technology that providers use when exchanging health 

information.27 HHS has issued a new edition of the standards and 

certification criteria that takes effect in 2014. Providers are required to use 

EHR technology certified to these standards beginning in 2014, 

regardless of whether they participated in the EHR programs in earlier 

years. Compared to the previous 2011 edition, the 2014 edition includes 

more certification criteria and specifies certain standards to support 

exchange, such as standards for the transmission of health information 

and a summary of care record standard that providers must use to 

participate in the EHR programs. For example, the standards require 

certified EHR technology to be able to transmit patient care summaries 

using a structured format, referred to as a continuity of care document 

(CCD), which allows providers to record health information using the 

same template.28

 

26F. R. Goss et al., “Evaluating Standard Terminologies for Encoding Allergy Information,” 

Journal of the American Medical Informatics Association, no. 20 (2013): 969-979. The 

article noted that while gaps still exist across standards related to allergies, some existing 

standards cover most allergy-related information.

In addition, in order to standardize the transmittal of 

health information, ONC has developed the Direct Protocol, which defines 

a standard format that providers can use to send secure health messages 

27Providers who participated in the EHR programs from fiscal year 2011 through fiscal 

year 2013 could use certified EHR technology that conformed to the 2011 edition of the 

standards and certification criteria. All providers that participate in the EHR Programs in 

fiscal year 2014 must conform to the 2014 edition of the standards and certification 

criteria. ONC is expected to develop another set of standards and certification criteria that 

certified EHR technology would be required to conform to beginning in 2016.

28The CCD was created to foster interoperability of clinical data by allowing physicians to 

send electronic medical information to other providers. CCDs provide information such as 

pertinent clinical, demographic, and administrative data for a specific patient. In Stage 2, 

CCDs are created using consolidated clinical document architecture, which is a base 

standard that provides a common architecture, coding, semantic framework, and markup 

language for the creation of electronic clinical documents that facilitates the exchange of 

health information.
 

Page 12 GAO-14-242 Electronic Health Record Information Exchange

from one entity to another.29 HHS expects that providers using the 2014 

edition will have greater ability to exchange information.30

Although progress has been made, as represented by the 2014 edition of 

the standards and certification criteria, concerns regarding standards 

remain. First, while the 2014 edition certification standards may lead to a 

greater ability to exchange information and HHS has tested the 

implementation of the standards among certain providers, HHS officials 

told us that the extent to which the standards will lead to widespread 

improvements in electronic health information exchange will remain 

unclear until a larger number of providers begin using technology that is 

certified to the standards. Second, some concerns regarding standards 

were not addressed through the 2014 edition, and several providers we 

interviewed said there is a need for standards that would allow all certified 

EHR technology to be interoperable so all types of health information 

could be electronically exchanged across providers. In addition, the AHA, 

in its response to HHS’s March 2013 RFI, stated that the 2014 edition 

does not require certified EHRs to support a standard to facilitate more 

advanced exchange than is supported by the Direct Protocol. The AHA 

noted that it is appropriate to require certified EHRs to support both the

Direct Protocol and other standards that would allow for more robust 

exchange so providers can choose which standard is appropriate for their 

needs when exchanging health information. Third, some providers 

suggested that there is a need for standards that enable providers to 

electronically exchange more detailed clinical information, such as patient 

narratives, than what is included in a CCD.31

 

29The Direct Protocol is part of ONC’s Direct Project and serves as a standard format to 

transmit and share clinical information necessary to satisfy some Stage 1 and Stage 2 

meaningful use requirements. For example, a primary care physician who refers a patient 

to a specialist can use the Direct Protocol to provide a clinical summary of that patient to 

the specialist and receive, in return, a summary of the consultation.

Fourth, one provider we 

interviewed noted that standards regarding allergies were insufficient and 

30CMS and ONC announced in December 2013 that the agencies plan to propose a 2015 

edition of the standards and certification criteria that would be voluntary for providers 

participating in the EHR programs. According to the agencies, this edition would respond 

to stakeholder feedback on the 2014 edition, and it would continue to advance health 

information exchange.

31Patient encounters are commonly recorded in free-form text narratives, or as 

unstructured clinical data. While free-form patient narratives give the provider flexibility to 

note observations that are not supported by structured data, they are not easily 

searchable and aggregated and can be more difficult to analyze. 
 

Page 13 GAO-14-242 Electronic Health Record Information Exchange

that RxNorm and the Systematized Nomenclature of Medicine Clinical 

Terms (SNOMED CT) should be expanded for nonmedication allergies 

and allergic reactions.32 Fifth, several providers and stakeholders 

commented that the Direct Protocol allows for limited exchange, such as 

exchanging a secure email message, rather than enabling certain other 

functionalities, such as the ability to query another EHR system.33

Reported variation in state privacy rules and lack of clarity about 

requirements. Some providers noted that exchanging health information 

with providers in other states can be difficult due to their limited 

understanding of variations in privacy rules from state to state. Some 

providers also noted that exchange can be especially difficult in cases 

when providers are located close to state borders and therefore serve 

patients from another state. Providers that are covered by the Health 

Insurance Portability and Accountability Act (HIPAA) of 1996 must adhere 

to federal privacy rules and can also be subject to state privacy rules.34

 

32RxNorm, developed by HHS’s National Library of Medicine, provides normalized names 

for clinical drugs and links its names to many of the drug vocabularies commonly used in 

pharmacy management and drug interaction software. SNOMED CT is a set of clinical 

terminology owned and maintained by the International Health Terminology Standards 

Development Organisation. RxNorm and SNOMED CT are examples of standards that 

are required by the 2014 edition of the standards and certification criteria.

These state rules can be more stringent than HIPAA requirements or 

standards.

33HHS officials stated that the Direct Protocol could be used to enable more sophisticated 

means of exchange, such as alerts to providers when patients are admitted to a hospital. 

However, the availability of these features varies by EHR vendor and geographic location.

34HIPAA’s Administrative Simplification Provisions required the establishment of, among 

other things, national privacy standards. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 

1936, 2021 (codified at 42 U.S.C. §§ 1320d–1320d-8). These provisions also expressly 

provided that such national standards would not preempt state laws that impose 

requirements, standards, or implementation specifications that are more stringent than 

those imposed under federal regulation. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 

1936, 2021, see 42 U.S.C. §§ 1320d–2 notes. HIPAA regulates covered entities’ 

(including most health care providers’) use and disclosure of personal health information. 

The Privacy Rule generally permits the use or disclosure of an individual’s protected 

health information without the individual’s written authorization for purposes of treatment, 

payment and health care operations. Under the Privacy Rule, more stringent state laws 

that are not preempted by federal law include those that prohibit or restrict a use or 

disclosure in circumstances under which such use or disclosure would be permitted under 

HIPAA. See 45 C.F.R. 160.202.
 

Page 14 GAO-14-242 Electronic Health Record Information Exchange

To address privacy issues related to electronic health information 

exchange, ONC officials have several ongoing efforts. For example, ONC 

has issued high-level guidance for providers on how to ensure the privacy 

and security of health information covering a wide range of topics related 

to meaningful use and the HIPAA Privacy and Security Rules, among 

other things. Regarding state privacy laws, this guidance suggests that 

providers seek information from state agencies, RECs, and professional 

associations to understand how state laws affect the sharing of patient 

health information. In addition, ONC began the Data Segmentation for 

Privacy Initiative to develop and pilot test standards for managing patient 

consents and data segmentation.35

Although ONC is working on privacy issues, some providers we spoke 

with reported that lack of clarity in state privacy laws is one reason that 

they have experienced difficulty exchanging health information with 

providers in other states. They found it difficult to ensure they were 

compliant with state laws when exchanging certain personal health 

information with providers in another state. For example, some providers 

in Minnesota and Massachusetts noted that some state laws have 

stringent requirements related to sharing health information related to 

mental health, or human immunodeficiency virus or other sexually 

transmitted infections. In addition, some providers told us that different 

providers in their state have different interpretations regarding how 

frequently they must obtain consent from the patient, as required under 

the state privacy rule, for the exchange of patients’ health information. For 

example, some providers may interpret the state privacy rule to mean that 

every time a patient’s health information is exchanged with another 

provider they have to obtain consent. Other providers in the same state 

may interpret the state privacy rule to mean that they have to obtain 

consent only once.

As part of this initiative, ONC released 

an implementation guide for consent management and data segmentation 

in the summer of 2012, and the agency is currently pilot testing this guide. 

In addition, ONC’s state HIE organization program is currently receiving 

reports from states on how they are implementing their state’s privacy 

rules. Officials expect to receive the information from states by March 

2014. ONC officials are hopeful that these efforts will help address 

privacy concerns and, as a result, facilitate exchange efforts for providers.

 

35Data segmentation is a process that enables the sharing of some but not all health 

information. According to researchers, data segmentation could enable patient control 

over the sharing or withholding of health information.
 

Page 15 GAO-14-242 Electronic Health Record Information Exchange

In addition to the privacy challenges identified by providers, stakeholders 

responding to HHS’s March 2013 RFI also identified privacy as a 

challenge related to health information exchange, and noted that 

additional training for providers on varying state privacy laws is needed to 

address this challenge. Stakeholders also suggested that HHS could 

focus more resources on consent policies and recommended that HHS 

undertake additional work to facilitate (1) electronically obtaining patient 

consent for disclosing health information, and (2) communicating that 

consent along with the related health information. 

Reported difficulty of accurately matching patients to their health 

records. Some providers we interviewed reported that they do not have 

an accurate and efficient way to match patients to their records when 

exchanging health information. Multiple providers and stakeholders cited 

situations in which several of their patients are listed with the same name 

and birth year, and live in the same area. Two of these providers reported 

that patients can be matched to the wrong set of records, and that 

providers often need to manually match records, which is timeconsuming. Some stakeholders also noted similar problems, including

safety concerns from incorrect patient matching.

HHS programs or initiatives to address patient matching issues related to 

health information exchange include both a patient matching project and 

efforts by two federal advisory committees. According to ONC officials, 

planning for the Patient Matching Initiative was begun by the State Health 

Information Exchange Cooperative Agreement Program in July 2013, and 

the project launched publicly in September 2013. The goals of the 

initiative are to (1) improve patient matching based on an assessment of 

current approaches used by selected stakeholders, (2) identify key 

attributes and algorithms for matching patients to their records, and 

(3) define processes or best practices to support the identified key 

attributes. The first phase of the initiative was completed in February 

2014 with the release of a report containing patient matching 

recommendations for possible inclusion in Stage 3 of the EHR programs 

and the 2015 edition of the standards and certification criteria.

36

 

36Audacious Inquiry, LLC, Patient Identification and Matching Final Report, a report 

prepared at the request of the Department of Health and Human Services, Office of the 

National Coordinator for Health Information Technology, Feb. 7, 2014.

The two 

federal advisory committees established under HITECH, the HIT Policy 

Committee and the HIT Standards Committee, made recommendations to 
 

Page 16 GAO-14-242 Electronic Health Record Information Exchange

HHS in 2011 that relate to patient matching.37

Although HHS has ongoing efforts to address the patient matching 

challenge, several providers and stakeholders commented that more 

work needs to be done on this issue. Some providers we interviewed use 

different methodologies, such as algorithms that make use of multiple 

patient attributes for identifying patients. However, providers told us that 

they still have challenges matching patients to their records. Several 

providers and stakeholders have stated that there should be a national 

patient identifier for matching patients to their records.

The HIT Policy Committee 

recommended standardized formats for demographic data fields, 

internally evaluating matching accuracy, accountability, developing, 

promoting and disseminating best practices, and supporting the role of 

the patient. The HIT Standards Committee made four recommendations 

on patient matching covering patient attributes that could be used, data 

quality issues, formats for data elements, and the data that could be 

returned from a match request. According to ONC officials, as of July 

2013 ONC had efforts under way to respond to these recommendations, 

under the Patient Matching Initiative, in coordination with the committees. 

For example, to address one recommendation related to developing, 

promoting, and disseminating best practices, ONC officials said that they 

plan to determine which approaches to patient matching work best and 

develop guidance to help organizations implement such steps.

38

 

37U.S. Department of Health and Human Services, Health IT Policy Committee letter to 

the National Coordinator for Health Information Technology, February 8, 2011, accessed 

September 10, 2013, 

Some 

stakeholders who responded to HHS’s March 2013 RFI stated that HHS 

has an opportunity to reduce the potential risks of engaging in exchange 

by focusing more resources on patient matching.

http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__policy_recommendati

ons/1815. U.S. Department of Health and Human Services, Health IT Standards 

Committee letter to the National Coordinator for Health Information Technology, 

August 17, 2011, accessed December 31, 2013, http://www.healthit.gov/policyresearchers-implementers/health-it-standards-committee-recommendations-nationalcoordinator-h. 

38HHS has stated that it is prohibited from implementing a national patient identifier and 

referred to the Omnibus Consolidated and Emergency Supplemental Appropriations Act of 

1999. The act prohibits HHS from using any funds to promulgate or adopt any final 

standard providing for, or providing for the assignment of, a unique health identifier for an 

individual until legislation is enacted specifically approving the standard. See Pub. L. 

No. 105-277, § 516, 112 Stat. 2681, 2681-386 (1998).
 

Page 17 GAO-14-242 Electronic Health Record Information Exchange

Reported challenges with cost of exchanging health information. 

Providers we interviewed reported challenges covering costs associated 

with health information exchange, including upfront costs associated with 

purchasing and implementing EHR systems, fees for participation in state 

or local HIE organizations, and per-transaction fees for exchanging health 

information charged by some vendors or HIE organizations. Several 

providers said that they must invest in additional capabilities such as 

establishing interfaces for exchange with laboratories or other entities 

such as HIE organizations. For example, many providers told us that the 

cost of developing, implementing, and maintaining interfaces with others 

to exchange health information is a significant barrier. One provider and 

several officials estimated various amounts between $50,000 and 

$80,000 that providers spend to establish data exchange interfaces. 

Other stakeholders we interviewed or who responded to HHS’s March 

2013 RFI also identified costs associated with participation in HIE 

organizations and maintaining EHR systems as a challenge for providers.

To address costs of exchanging health information, ONC’s State Health 

Information Exchange Cooperative Agreement Program has provided 

funding to HIE organizations.39 Agency officials stated that by funding HIE 

organizations, a relatively low cost option can be made available for 

providers to use to exchange health information. However, ONC officials 

said that this program is scheduled to end in March 2014.40

 

39ONC’s State Health Information Exchange Cooperative Agreement Program has 

provided funding for 56 states, eligible territories, and qualified State Designated Entities 

since March 2010.

In addition, 

several providers we interviewed told us that for them the benefits to them 

of joining an HIE organization often do not exceed the costs, in some 

cases because few providers have joined their state or regional HIE 

organizations, resulting in limited opportunities to exchange health 

information. Some providers told us they do not participate in HIE 

organizations because they exchange information in other ways that they 

believe are more efficient, such as exchanging directly with other 

providers that use the same EHR system from the same vendor. One 

ONC officials also stated that the Direct Protocol is a low-cost option for exchanging 

health information, and therefore may help providers reduce the cost of exchanging health 

information.

40Two states, Florida and Ohio, requested to end their funding support from ONC’s State 

Health Information Exchange Cooperative Agreement Program in fall 2013, according to 

ONC officials.
 

Page 18 GAO-14-242 Electronic Health Record Information Exchange

study noted that most health care providers, including over 65 percent of 

hospitals and 90 percent of physician practices, were not participating in 

HIE organizations.41

HHS payments to providers under the EHR programs can help support 

the cost of exchange, but providers can participate in the programs 

without routinely exchanging information electronically that could lead to 

improved care. While some of the meaningful use requirements for 

Stage 1 and Stage 2 help to facilitate the exchange of health information, 

they require exchange only under certain circumstances. (See app. II for 

more information.) For example, one part of the requirement to provide a 

summary care document for each transition of care or referral in Stage 2 

compels providers to complete either (1) one successful electronic 

exchange of a summary of care record with a recipient using technology 

designed by an EHR developer other than the sender’s, or (2) one 

successful test with CMS’s test EHR during the reporting period.42 One 

stakeholder we spoke with explained that for this part of the requirement 

some providers just complete one successful test with CMS’s test EHR 

and do not routinely demonstrate exchanging health information 

electronically with other EHR systems. HHS officials stated that Stage 2 is 

an incremental step toward advancing exchange, and that providers 

generally do not yet have the technology to enable greater exchange.

 

41J. Adler-Milstein, D. W. Bates, and A. K. Jha, “Operational Health Information 

Exchanges Show Substantial Growth, but Long-Term Funding Remains a Concern,” 

Health Affairs, vol. 32, no. 8 (2013).

42The requirement to provide a summary of care document for each transition of care or 

referral in Stage 2 also requires eligible professionals and hospitals to provide summary of 

care documents for more than 10 percent of transitions of care and referrals either 

(1) electronically transmitted using certified EHR technology or (2) through an exchange 

with an organization that is a Nationwide Health Information Network Exchange participant 

or in a way that is consistent with the Nationwide Health Information Network. The 

Nationwide Health Information Network was a program funded by ONC that transitioned to 

the eHealth Exchange, a group of federal agencies and nonfederal organizations whose 

mission, among other things, is to improve public health reporting through secure, trusted, 

and interoperable health information exchange.

CMS and ONC have identified a minimum set of technical capabilities that are required for 

an EHR to be considered a test EHR. Eligible professionals and hospitals that select to 

attest to this requirement will be randomly matched with a designated test EHR that is 

designed by an EHR developer other than the sender’s.
 

Page 19 GAO-14-242 Electronic Health Record Information Exchange

HHS, including CMS and ONC, developed and issued a strategy 

document in August 2013 that describes how it expects to advance 

electronic health information exchange, with principles to guide future 

actions in three broad areas—accelerating health information exchange, 

advancing standards and interoperability, and patient engagement.43

While HHS officials intend these principles to lead to future actions that 

have the potential to address key challenges, the HHS strategy does not 

specify any such actions, how any actions should be prioritized, what 

milestones the actions need to achieve, or when milestones need to be 

accomplished. Our previous work, consistent with GPRAMA, sets forth 

several key elements of strategies that can guide agencies in planning 

and implementing an effective government program.

Examples of principles in the strategy include (1) working with multiple 

stakeholders to develop standards and facilitating the adoption and use of 

standards among federal agencies; (2) supporting the privacy, security, 

and integrity of patient health information across health information 

exchange activities; (3) seeking to enable a patient’s health information to 

be available wherever the patient accesses care, to support patientcentered care delivery; and (4) supporting exchange through state-led

efforts to reduce costs to providers. (See app. III for a complete list of 

principles.) According to the strategy, these principles have the potential 

to address the key health information challenges identified by providers 

and stakeholders we interviewed, which relate to standards, patients’ 

privacy, matching patients with data, and costs.

44

 

43For more information, see the Department of Health and Human Services, the Office of 

the National Coordinator for Health Information Technology, and the Centers for Medicare 

& Medicaid Services, Principles and Strategy for Accelerating Health Information 

Exchange (HIE), (Aug. 7, 2013).

As noted in our 

prior work, elements such as specific actions, priorities, and milestones 

are desirable for evaluating progress, achieving results in specific time 

frames, and ensuring effective oversight and accountability. These 

elements can also be used to gauge progress when implementing 

44GAO-04-408T. 

See Pub L. No. 103-62, 107 Stat. 285 (1993) (GPRA), as amended by Pub. L. No. 111-

352, 124 Stat. 3866 (2011) (GPRAMA). GPRA requires, among other things, that federal 

agencies develop strategic plans that include agencywide goals and strategies for 

achieving those goals. We have reported that these requirements also can serve as 

leading practices for planning at lower levels within federal agencies, such as individual 

programs or initiatives.

HHS Developed an 

Electronic Health 

Information Exchange 

Strategy That 

Includes Principles to 

Address Key 

Challenges but Lacks 

Specific Prioritized 

Actions and 

Milestones
 

Page 20 GAO-14-242 Electronic Health Record Information Exchange

programs and to determine whether adjustments need to be made in 

order to maintain progress within given time frames.45

• Specific Actions. While the strategy mentions that HHS seeks to 

enable a patient’s health information to be available wherever the 

patient accesses care, it does not indicate specific actions that HHS 

will take to implement that principle or how those actions would 

overcome exchange-related challenges. Including specific actions 

could enhance the strategy’s usefulness for helping to make program 

management decisions.

Below are 

examples of how the lack of these elements affects the HHS strategy.

• Prioritized Actions. While the HHS strategy states that HHS will 

continue to evaluate short- and long-term steps to advance exchange, 

it does not clearly delineate how future actions related to the 

principles should be prioritized. Prioritizing actions can help HHS 

ensure that the most appropriate activities are completed first, to more 

efficiently achieve the goal of advancing exchange.

• Milestones. The HHS strategy does not provide milestones with 

specific time frames to help the agencies gauge their progress in 

advancing exchange. Exchange-related milestones with specified time 

frames could be particularly useful because they could provide a 

framework for determining whether any actions HHS intends to take 

could help lead to progress in addressing the challenges providers 

face related to exchange. Milestones with time frames could also set 

realistic expectations so stakeholders can anticipate when they can 

expect to see actions to advance exchange.

CMS and ONC officials acknowledged the importance of providers being 

able to exchange health information effectively by Stage 3 of the EHR 

programs to allow for improved outcomes such as quality, efficiency, and 

patient safety. Determining specific, prioritized actions and exchangerelated milestones with specified time frames can help to ensure that the 

agencies’ principles and future actions result in timely improvements in 

addressing the key exchange-related challenges reported by providers 

and stakeholders, which are particularly important because planning for 

Stage 3 is expected to begin as soon as 2014. This information could also 

 

45GAO, Agency Performance Plans: Examples of Practices That Can Improve Usefulness 

to Decisionmakers, GAO/GGD/AIMD-99-69 (Washington, D.C.: Feb. 26, 1999), and GAO, 

Executive Guide: Effectively Implementing the Government Performance and Results Act,

GAO/GGD-96-118 (Washington, D.C.: June 1996).
 

Page 21 GAO-14-242 Electronic Health Record Information Exchange

help HHS prioritize its future actions based on whether health information 

is being exchanged effectively among providers, in order to better achieve 

the EHR programs’ ultimate goals of improving quality, efficiency, and 

patient safety.

HHS and providers have made some progress toward addressing 

challenges reported by providers and others related to the electronic 

exchange of health information, but these challenges are complex and 

difficult to address and are likely to continue to persist. Some of HHS’s 

most important efforts, such as designing the 2014 edition of the 

standards and certification criteria to include an increased exchange 

capability in EHR systems, may lead to greater exchange over the next 

year. In addition, exchange may increase as providers modify their 

systems to meet more stringent exchange-related requirements in 

Stage 2 of the EHR programs. However, a number of remaining 

challenges make these outcomes uncertain.

HHS has both ongoing programs and future plans to address concerns 

about exchange, but it is not always clear how HHS will effectively 

prioritize and implement its potential responses to the challenges of 

exchange. Specifically, the HHS strategy to advance electronic health 

information exchange does not identify specific actions that CMS and 

ONC expect will lead to increased exchange, prioritize these actions, or 

include milestones for gauging progress over time. Guidance on planning 

and implementing effective strategies highlights the importance of key 

elements, such as specific, prioritized actions and milestones for gauging 

progress. These elements could help the agencies make future 

adjustments based on the effectiveness of their efforts. Exchange is 

especially important because of its potential to help improve coordination 

of care within the fragmented health care system. According to CMS and 

ONC officials, ensuring progress in providers’ ability to electronically 

exchange information is critical for the effective implementation of the 

EHR programs. Without a sufficient focus on exchange—including 

specific, prioritized actions with milestones and time frames—CMS and 

ONC run the risk that the desired outcomes of the EHR programs of 

improved quality, efficiency, and patient safety will be compromised.

Conclusions
 

Page 22 GAO-14-242 Electronic Health Record Information Exchange

To address challenges that affect the ability of providers to electronically 

exchange health information, we recommend that the Secretary of Health 

and Human Services direct CMS and ONC to take the following two 

actions:

• develop and prioritize specific actions that HHS will take consistent 

with the principles in HHS’s strategy to advance health information 

exchange; and

• develop milestones with time frames for the actions to better gauge 

progress toward advancing exchange, with appropriate adjustments 

over time.

We provided a draft of this report to HHS for comment. HHS provided 

written comments, which are reprinted in appendix IV. HHS concurred 

with our recommendations. For the first recommendation, HHS (including 

CMS and ONC) stated that it has begun to develop and prioritize specific 

action items, consistent with the principles in its strategy to advance 

health information exchange, and that it has begun to take action on 

some of the prioritized items. For the second recommendation, HHS 

(including CMS and ONC) stated that it has begun developing milestones 

with time frames for the actions to better gauge progress toward 

advancing exchange. In general, HHS’s comments also reiterated that the 

electronic exchange of health information is a key element of meaningful 

use and ultimately will be critical for the success of health care delivery 

system reforms under the Patient Protection and Affordable Care Act. 

HHS also stated that it has begun to take definitive steps to accelerate 

exchange through policy guidance, grant funding to states, and 

development of standards and certification, such as collaborating with 

private sector organizations that develop health IT standards to fill key 

gaps in standards to better support information exchange during 

transitions in care and when coordinating care across providers. 

Additionally, HHS provided technical comments, which we incorporated 

as appropriate.

We are sending copies of this report to the Secretary of Health and 

Human Services, the Administrator of CMS, the National Coordinator for 

Health Information Technology, and other interested parties. In addition, 

the report will be available at no charge on GAO’s website at 

http://www.gao.gov. 

Recommendations for 

Executive Action

Agency Comments
 

Page 23 GAO-14-242 Electronic Health Record Information Exchange

If you or your staffs have any questions about this report, please contact 

me at (202) 512-7114 or at kohnl@gao.gov. Contact points for our Office 

of Congressional Relations and Office of Public Affairs can be found on 

the last page of this report. Other major contributors to this report are 

listed in appendix V.

Linda T. Kohn

Director, Health Care
Page 24 GAO-14-242 Electronic Health Record Information Exchange

List of Committees

The Honorable Ron Wyden

Chairman

The Honorable Orrin G. Hatch

Ranking Member

Committee on Finance

United States Senate

The Honorable Tom Harkin

Chairman

The Honorable Lamar Alexander

Ranking Member

Committee on Health, Education, Labor, and Pensions

United States Senate

The Honorable Thomas R. Carper 

Chairman

The Honorable Tom Coburn, M.D.

Ranking Member

Committee on Homeland Security and Governmental Affairs 

United States Senate

The Honorable Tom Harkin 

Chairman 

The Honorable Jerry Moran

Ranking Member 

Subcommittee on Labor, Health and Human Services, Education, 

 and Related Agencies

Committee on Appropriations

United States Senate

The Honorable Fred Upton

Chairman

The Honorable Henry A. Waxman

Ranking Member

Committee on Energy and Commerce

House of Representatives
Page 25 GAO-14-242 Electronic Health Record Information Exchange

The Honorable Darrell E. Issa

Chairman 

The Honorable Elijah E. Cummings

Ranking Member

Committee on Oversight and Government Reform 

House of Representatives

The Honorable Dave Camp

Chairman

The Honorable Sander M. Levin

Ranking Member

Committee on Ways and Means

House of Representatives

The Honorable Jack Kingston

Chairman 

The Honorable Rosa DeLauro

Ranking Member

Subcommittee on Labor, Health and Human Services, Education, 

 and Related Agencies

Committee on Appropriations

House of Representatives
Appendix I: Information Reported by Providers 

on the Electronic Exchange of Health 

Information and Its Related Benefits

Page 26 GAO-14-242 Electronic Health Record Information Exchange

This appendix provides additional information reported from providers we 

spoke with about health information exchange and its related benefits. 

We conducted a total of 25 interviews with providers and stakeholders, 

such as regional extension centers (REC) and health information 

exchange organizations (HIE organization), in four states—Georgia, 

Massachusetts, Minnesota, and North Carolina. We interviewed staff from 

at least two hospitals or health systems and at least one physician office 

or group practice in each state. We selected the four states because they 

were mentioned during interviews with officials from HHS and relevant 

stakeholders as having ongoing efforts related to health information 

exchange. We asked interviewees about what types of patient health 

information providers are currently able to electronically exchange, the 

methods used to exchange such information, and the benefits providers 

have realized or foresee from such exchange.

Providers we interviewed reported that the most critical types of health 

information that they need to be able to electronically exchange include 

patient allergy information, medication lists, and problem lists. However, 

providers generally reported being able to electronically exchange only 

specific types of health information at this time, including lab orders and 

results, immunization and prescription information, and certain clinical 

documents. For example,

• Almost all the providers we interviewed reported some exchange of 

lab information. In most cases, such exchanges involved both the 

submission of lab orders and the receipt of lab results via interfaces 

designed for exchange between providers and labs or through their 

electronic health record (EHR) system. While these exchanges were 

reported to generally occur between providers and laboratories 

outside their organizations, two providers noted that such capabilities 

were still limited to sharing lab information with others in the same 

health system.

• Some providers also reported electronically exchanging some 

information with state public health departments, generally 

immunization data and notification of certain infectious diseases. They 

said that these electronic exchanges were generally limited to 

submissions to the departments and did not include receipt of data 

from these departments.

• Several of the providers we interviewed said they engaged in eprescribing activities, which in some instances included both the 

submission of electronic prescriptions to pharmacies and the receipt 

of medication information from pharmacies. However, some providers 

Appendix I: Information Reported by 

Providers on the Electronic Exchange of 

Health Information and Its Related Benefits
Appendix I: Information Reported by Providers 

on the Electronic Exchange of Health 

Information and Its Related Benefits

Page 27 GAO-14-242 Electronic Health Record Information Exchange

noted that such exchanges could take place only if the pharmacy had 

a compatible e-prescribing system that could electronically receive 

prescription information from the provider’s EHR system. In the 

absence of compatible systems, faxes were used.

• Several providers we interviewed also noted that they could exchange 

continuity of care documents (CCD) with other providers in their 

organization, although the exchange of this type of information varied 

among the providers we interviewed.1

Providers in all four states and stakeholders that we interviewed reported 

that, at this time, methods used to electronically exchange health 

information are limited to use within health systems, use between certain 

EHR systems, or use of the Direct Protocol.

Several providers said they 

could exchange CCDs within their health system, whereas other 

providers said they could exchange this information only with 

providers using the same EHR vendor.

2

• In Georgia, REC officials and the four providers we spoke with told us 

that electronic exchange is generally occurring only within health 

systems and among those affiliated providers that work in the health 

systems. Some providers noted that they could electronically 

exchange lab orders and results outside their organizations, but one 

provider noted that even this information was still exchanged 

electronically only within its hospital.

For example,

• Providers in Minnesota, Massachusetts, and North Carolina reported 

that they used the same EHR system from the same vendor and were 

able to electronically exchange all patient clinical information with any 

other entity using that vendor via an interoperability feature.3

 

1

The Continuity of Care Document (CCD) was created to foster interoperability of clinical 

data by allowing physicians to send electronic medical information to other providers. The 

purpose of the CCD is to allow the transmission of information without loss of clinical 

meaning. CCDs provide information such as pertinent clinical, demographic, and 

administrative data for a specific patient.

2

The Direct Protocol is part of the Office of the National Coordinator for Health Information 

Technology’s (ONC) Direct Project and serves as a standard format to transmit and share 

clinical information necessary to satisfy some Stage 1 and Stage 2 meaningful use 

requirements for the EHR programs. For example, a primary care physician who refers a 

patient to a specialist can use the Direct Protocol to provide a clinical summary of that 

patient to the specialist and receive, in return, a summary of the consultation.

3

Interoperability is the ability of two or more systems or components to exchange 

information and use the information that has been exchanged.
Appendix I: Information Reported by Providers 

on the Electronic Exchange of Health 

Information and Its Related Benefits

Page 28 GAO-14-242 Electronic Health Record Information Exchange

According to these providers, this interoperability feature provides a 

mechanism for them to electronically exchange all types of clinical 

information about their patients.

• A community-based hospital in Minnesota reported using a different 

EHR system than was used by the other, larger health systems in the 

community it shared information with. This provider reported relying 

on the Direct Protocol to electronically exchange some limited health 

information with other providers in the region. A provider in 

Massachusetts noted that it was building web-based “view portals” to 

allow other providers outside its health system to view health 

information electronically in order to help coordinate patient care.

Providers that participated in an HIE organization reported being able to 

electronically exchange health information with other providers. Others 

have opted to electronically exchange information using their EHR 

technology rather than an HIE organization, even if one was available.

• In Massachusetts, some providers told us that they are able to directly 

connect to the state’s HIE organization in order to electronically 

exchange health information, such as CCDs. However, not all 

providers in the state are electronically exchanging information at this 

time. A Massachusetts law calls for the creation and maintenance of a 

state HIE organization that allows providers in all health care settings 

to exchange patient health information with other providers by the end 

of 2016.4

• Some providers we spoke with in Minnesota said they had no plans to 

join any of the HIE organizations available in the state at this time due 

to the limited benefits they would realize from participating, and would 

instead continue to rely on their EHR technology to electronically 

exchange health information with other providers that use the same 

vendor. Some providers noted that without a sufficient number of 

other providers participating in an HIE organization, it would be of 

limited value.

• Several Georgia and North Carolina providers reported that the 

availability of an HIE organization could help facilitate electronic 

exchange among providers. Entities in both states are establishing 

regional HIE organizations that will ultimately connect to one another 

via a statewide HIE organization. Providers in both states said they 

 

4

See 2012 Mass. Acts. ch. 224 (August 6, 2012).
Appendix I: Information Reported by Providers 

on the Electronic Exchange of Health 

Information and Its Related Benefits

Page 29 GAO-14-242 Electronic Health Record Information Exchange

expected that the HIE organizations, once established, would facilitate 

broader electronic exchange of health information throughout the 

state.

Although providers we interviewed described certain circumstances when 

they could electronically exchange health information, they indicated that 

they would like to expand the electronic exchange of health information 

and cited a variety of benefits related to such electronic exchange. For 

example, some providers noted that electronic exchange can

• provide access to critical information needed when administering 

medical care, thus improving care quality and reducing duplicative 

testing;

• improve access to information related to a patient’s health history, 

including medication histories and previous diagnoses;

• result in more timely access to information, which is particularly 

helpful in emergency departments; and

• reduce labor-intensive efforts to send and receive health information 

in paper form, such as a printed document, or conduct public health 

reporting activities.
Appendix II: Stage 1 and Stage 2 Meaningful 

Use Measures Related to Electronic Health 

Information Exchange

Page 30 GAO-14-242 Electronic Health Record Information Exchange

This appendix provides information on the Stage 1 and Stage 2 

meaningful use measures related to electronic health information 

exchange, according to officials from the Centers for Medicare & 

Medicaid Services (CMS) and the Office of the National Coordinator for 

Health Information Technology (ONC). According to these officials, 

Stage 2, which began in 2014, provides additional requirements related to 

the exchange of health information. For example, some meaningful use 

measures related to health information exchange that providers could 

select from a menu of optional measures in Stage 1 are mandatory for 

Stage 2. In addition, some Stage 2 measures are new. For example, the 

measure “provide structured electronic lab results to ambulatory 

providers” is a new measure for hospitals in Stage 2. See table 1 for more 

information.

Appendix II: Stage 1 and Stage 2 Meaningful 

Use Measures Related to Electronic Health 

Information Exchange
Appendix II: Stage 1 and Stage 2 Meaningful 

Use Measures Related to Electronic Health 

Information Exchange

Page 31 GAO-14-242 Electronic Health Record Information Exchange

Table 1: Meaningful Use Measures Related to Electronic Health Information Exchange According to the Centers for Medicare 

& Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC), Stage 1 and 

Stage 2

Hospitals Professionals

Meaningful use measure related to electronic health information exchange Stage 1 Stage 2 Stage 1 Stage 2

Generate and transmit permissible prescriptions electronically: For hospitals for 

Stage 2, generate, transmit, and check each prescription for the existence of a

relevant drug formulary for more than 10 percent of hospital discharge prescriptions; 

for professionals, generate and transmit more than 40 percent (for Stage 1) or more 

than 50 percent (for Stage 2) of permissible prescriptions electronically and for 

Stage 2 also check each prescription for the existence of a relevant formulary

 ● ●

Provide patients with their health information electronically: For Stage 1: provide 

information (for hospitals and professionals, provide diagnostic test results, problem 

list, medication lists, and medication allergies, and for hospitals also provide

discharge summary and procedures) within 3 business days to more than 50 percent 

of patients who requested to receive that information electronically. For Stage 2: 

provide more than 50 percent of patients online access to their health information 

within 36 hours of discharge (for hospitals) or 4 days (for professionals); more than 

5 percent of patients view, download, or transmit their health information to a third 

party

●a ● ●a ●

For hospitals, provide patients with electronic copy of discharge instructions at 

the time of discharge, upon request; for professionals, provide patients with 

clinical summaries for each office visit: For hospitals, provide information for more 

than 50 percent of patients who requested that information; for professionals, provide 

information for more than 50 percent of visits within 3 business days for Stage 1 or 

1 business day for Stage 2

● b ●c ●

Exchange key clinical information electronically: Perform at least one test of 

electronic health record technology’s capacity to exchange key clinical information

●d ●d

Incorporate clinical lab-test results into electronic health records as structured 

data: Incorporate into the electronic health record technology more than 40 percent 

(for Stage 1) or 55 percent (for Stage 2) of the clinical lab test results ordered whose 

results are positive, negative, or in numerical format

e ●e e ●e

Perform medication reconciliation for patients received from another setting of 

care or provider of care: Perform for more than 50 percent of transitions of care

c ●c c ●c

Provide summary of care document for each transition of care or referral: For 

Stage 1 and Stage 2, provide for more than 50 percent of transitions of care and 

referrals; for Stage 2 also (a) provide for more than 10 percent of transitions of care 

and referrals either electronically transmitted using certified electronic health record 

technology or through an exchange with a Nationwide Health Information Network 

Exchange participant or in a way that is consistent with the Nationwide Health 

Information Networkf

and (b) conduct one or more successful electronic exchanges of 

a summary of care document with a recipient with electronic health record technology 

designed by a different developer than the sender’s or conduct one or more 

successful tests with the CMS-designated test electronic health record

 ●  ●

Submit electronic data to immunization registries or immunization information 

systems: For Stage 1, perform at least one test of electronic health record 

technology’s capacity to submit data to immunization registries and, if test is 

successful, institute regular reporting; for Stage 2, demonstrate successful ongoing 

submission of data to immunization registries

 ●  ●
Appendix II: Stage 1 and Stage 2 Meaningful 

Use Measures Related to Electronic Health 

Information Exchange

Page 32 GAO-14-242 Electronic Health Record Information Exchange

Hospitals Professionals

Meaningful use measure related to electronic health information exchange Stage 1 Stage 2 Stage 1 Stage 2

Submit electronic syndromic surveillance data to public health agencies: For 

Stage 1, perform at least one test of electronic health record technology’s capacity to 

submit data to public health agencies and, if test is successful, institute regular

reporting; for Stage 2, demonstrate successful ongoing submission of data to public 

health agencies

 ●  

Submit electronic data on reportable lab results to public health agencies: For 

Stage 1, perform at least one test of electronic health record technology’s capacity to 

submit data (as required by state or local law) to public health agencies and, if test is 

successful, institute regular reporting; for Stage 2, demonstrate successful ongoing 

submission of data (as required by state or local law) to public health agencies

 ●

Use secure electronic messaging to communicate with patients: More than 

5 percent of patients sent the professional a secure message

●

Provide patients with timely electronic access to their health information: 

Provide electronic access to health information (including lab results, problem list, 

medication lists, and allergies) to at least 10 percent of patients within 4 business 

days

g b

Ensure that imaging results and accompanying information are accessible 

through certified electronic health record technology: Make more than 10 

percent of all tests with one or more images accessible through certified electronic 

health record technology

 

Demonstrate capability to identify and report cancer cases to public health 

central cancer registry: Demonstrate successful ongoing submission of cancer case 

information from certified electronic health record technology to a public health central 

cancer registry



Demonstrate capability to identify and report specific cases to a specialized 

registry: Demonstrate successful ongoing submission of specific case information 

from certified electronic health record technology to a specialized registry other than a 

cancer registry



Provide structured electronic lab results to ambulatory providers: Send 

structured electronic clinical lab results to the ordering provider for more than 

20 percent of electronic lab orders



Source: GAO analysis of guidance from the Centers for Medicare & Medicaid Services (CMS) and of information obtained from officials 

from CMS and the Office of the National Coordinator for Health Information Technology (ONC).

Note: Mandatory measures are indicated by a filled circle (●), and optional measures are indicated 

by an open circle ().

a

Beginning in 2014, the Stage 2 criteria apply for Stage 1 with the exception that there is no 

requirement that patients view, download, or transmit their health information.

b

For Stage 2, this measure was incorporated into the “provide patients with their health information 

electronically” measure.

c

ONC did not indicate that this measure is related to health information exchange.

d

This requirement was eliminated from the Stage 1 requirements beginning in 2013.

e

While CMS officials did not indicate that this measure is related to the actual transfer of health 

information between entities, they did explain that this measure helps enable exchange by allowing 

information to be structured in such a way that when it is transferred it is usable by the recipient. CMS 

officials also stated that various other meaningful use measures (not included in this table) fulfill this 

purpose.
Appendix II: Stage 1 and Stage 2 Meaningful 

Use Measures Related to Electronic Health 

Information Exchange

Page 33 GAO-14-242 Electronic Health Record Information Exchange

f

The Nationwide Health Information Network, funded by ONC, provides a set of standards, services, 

and policies that enable the secure exchange of health information over the Internet.

g

This requirement was eliminated from the Stage 1 requirements beginning in 2014.
Appendix III: CMS and ONC Principles to 

Facilitate Health Information Exchange

Page 34 GAO-14-242 Electronic Health Record Information Exchange

This appendix provides information on the principles that the Centers for 

Medicare & Medicaid Services (CMS) and the Office of the National 

Coordinator for Health Information Technology (ONC) plan to use to 

guide their future actions to facilitate health information exchange. These 

principles are outlined in a strategy that the agencies released in August 

2013 to describe how they expect the principles to lead to future actions 

that have the potential to address the key challenges providers and 

stakeholders have identified relative to electronic health information 

exchange in four areas—standards, patients’ privacy, matching patients 

with data, and costs.1 The strategy includes principles under three broad 

categories—accelerating health information exchange, advancing 

standards and interoperability, and patient engagement. See table 2 for 

more information.

 

1

For more information, see Office of the National Coordinator for Health Information 

Technology and the Centers for Medicare & Medicaid Services, Principles and Strategy 

for Accelerating Health Information Exchange (HIE). August 7, 2013.

Appendix III: CMS and ONC Principles to 

Facilitate Health Information Exchange
Appendix III: CMS and ONC Principles to 

Facilitate Health Information Exchange

Page 35 GAO-14-242 Electronic Health Record Information Exchange

Table 2: The Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health 

Information Technology (ONC) Principles Related to Health Information Exchange

CMS and ONC Categories CMS and ONC Principles

Accelerating Health Information Exchange Seek to ensure that all new regulations and guidance on existing programs enable a 

patient’s health information to follow them wherever they access care to support patientcentered care delivery.

Implement policies that encourage health information exchange incrementally and could 

evolve from incentive and reward structures to ultimately considering health information 

exchange a standard business practice for providers.

Enable health information exchange where possible in support of state-led delivery and 

payment reform through federal and state partnerships.

Encourage interoperability across states’ electronic information infrastructures, including 

Medicaid and State Survey Agencies and other Department of Health and Human 

Services (HHS)–funded enterprise systems.

Collaborate with other departments in the federal government to facilitate the adoption 

and use of HHS health information technology (HIT) standards and interoperability 

requirements by those departments and their constituents.

Educate consumers from diverse cultural and socioeconomic backgrounds on health 

information exchange and what it means for them.

Support the privacy, security, and integrity of patient health information across all of its 

health information exchange acceleration activities.

Advancing Standards and Interoperability Advance multi-stakeholder development of standards through the Standards and 

Interoperability Framework and coordination with standards development organizations 

such as Health Level 7 Internationala

Accelerate interoperability through adoption of HIT standards through a variety of 

policies and programs, informed by advice from the HIT Policy Committee, the HIT 

Standards Committee, and the National Committee on Vital and Health Statistics.

Align HIT standards for quality measurement and improvement across Medicare and 

Medicaid programs when appropriate.

Accelerate alignment and implementation of electronic clinical quality measures, 

electronic decision support interventions, and electronic reporting mechanisms.

Develop standards and policies to enable electronic management of consent and health 

information exchange among providers treating patients with sensitive health data such 

as those with behavioral health conditions or HIV.

Strengthen data provenance to enhance providers’ confidence in the original source of 

the data they receive.

Patient engagement Support appropriate patient access to their health information.

Support appropriate access to a patient’s health information by family care givers.

Make HHS standardized data available to patients wherever possible.

Source: GAO analysis of HHS data.

a

Health Level 7 International is an organization that develops standards for exchanging electronic 

health information. These standards define how information is packaged and communicated from one 

entity to another, setting the language, structure, and data types required for integration between 

systems.
Appendix IV: Comments from the Department 

of Health and Human Services

Page 36 GAO-14-242 Electronic Health Record Information Exchange

Appendix IV: Comments from the 

Department of Health and Human Services
Appendix IV: Comments from the Department 

of Health and Human Services

Page 37 GAO-14-242 Electronic Health Record Information Exchange
Appendix IV: Comments from the Department 

of Health and Human Services

Page 38 GAO-14-242 Electronic Health Record Information Exchange
Appendix V: GAO Contact and Staff 

Acknowledgments

Page 39 GAO-14-242 Electronic Health Record Information Exchange

Linda T. Kohn, (202) 512-7114 or kohnl@gao.gov

In addition to the contact named above, Will Simerl, Assistant Director; 

La Sherri Bush; Thomas Murphy; Monica Perez-Nelson; Roseanne Price; 

Andrea Richardson; Teresa Tucker; and Rebecca Rust Williamson made 

key contributions to this report.

Appendix V: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(291116)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.