Electronic Personal Health Information Exchange: Health Care Entities' Reported Disclosure Practices and Effects on Quality of Care
Published: 2010-02-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To promote the use of information technology for the electronic exchange of personal health information among providers and other health care entities, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act. It provides incentives intended to promote the widespread adoption of technology that supports the electronic sharing of data among hospitals, physicians, and other health care entities. Pursuant to a requirement in the HITECH Act, GAO is reporting on practices implemented by health information exchange organizations, providers, and other health care entities that disclose electronic personal health information. GAO's specific objectives were to describe (1) the practices implemented for disclosing personal health information for purposes of treatment, including the use of electronic means for obtaining consent, as reported by selected health information exchange organizations, their participating providers, and other entities; and (2) the effects of the electronic sharing of health information on the quality of care for patients as reported by these organizations. To address both objectives, GAO conducted case studies of 4 of more than 60 operational health information exchanges and a selection of each of the exchanges' participating providers.
section_title: What GAO Found
paragraphs: The health care entities GAO studied reported that they implement disclosure practices that reflect widely accepted practices for safeguarding personal information-the Fair Information Practices-to help ensure the appropriate use and disclosure of electronic personal health information for treatment purposes. For example, providers in the study described various implementations of practices that require direct interaction with patients, such as informing patients of the use and disclosure of personal health information and providing patients access to their own records. Some of them inform patients that their electronic personal health information may be shared through health information exchanges-entities that were formed to facilitate the electronic sharing of patients' health information among providers. Both the providers and exchanges in the study described practices that limit disclosure of information, secure electronic information that they store and transmit, and help ensure accountability for safeguarding electronic personal health information. Although the health information exchanges reported that they have not conducted formal studies or evaluations of the overall effect of electronically sharing personal health information, both the exchanges and providers reported examples of ways that sharing electronic personal health information about patients has had a positive effect on the quality of care that providers deliver to patients. (1) Officials from two exchanges stated that they provide a direct connection from participating hospitals to their state's Department of Public Health for real-time reporting of conditions and for supporting the early detection of disease outbreaks. According to one of these officials, this service facilitated the state's ability to obtain information about cases of H1N1 more quickly than other states. (2) A large hospital that participated in one of the exchanges reported that a cardiologist was able to obtain an abnormal laboratory result electronically from the exchange one day earlier than they would have otherwise. This timely access to the patients' electronic health information allowed the provider to perform earlier intervention for a potentially life-threatening condition. (3) Another hospital reported that information obtained through its health information exchange helped its emergency department physician ascertain that a patient who was requesting medication for pain had been in five area hospitals in seven nights seeking pain medication. As a result, the physician did not prescribe any additional pain medication.

section_title: Letter
paragraphs: Studies published by the Institute of Medicine and other organizations  have shown that the fragmented and inaccessible state of medical  information can adversely affect the quality of health care and  compromise patient safety. This is important because patients may visit a  variety of different health care providers to meet their health care needs.  For example, for treatment of a chronic condition, a patient could visit a  primary care doctor, a specialist, a clinical laboratory, an imaging center,  and a pharmacy. Each of these providers may maintain records of medical  treatment, laboratory results, medications, and health history and personal  information about the patient that may also be needed by other providers  but is not readily available except in printed form. As a result, providers  may not have access to critical information needed to treat patients, such  as allergies to medicines, timely lab test results, and medical histories.
The use of information technology to electronically collect, store, and  share patients’ personal health information could help providers obtain  information about patients more quickly than they can in the current  medical records environment. Over the past several years, an increasing  number of organizations have implemented technology to enable the  electronic exchange of personal health information among providers,  including health information exchanges (HIE). These exchanges provide  the technology and facilities needed to support the electronic sharing of  data among hospitals, physicians, clinical laboratories, radiology centers,  pharmacies, health plans (insurers), and public health departments. Other  types of entities, such as integrated health care delivery systems, have  also increased the extent to which they share patients’ personal health  information electronically among providers.
While sharing health information electronically can help providers obtain  more timely and accurate information about the patients they are treating,  it may also increase the potential for misuse of personal health  information for illegal purposes, such as discriminatory employment  practices and health identity theft. Additionally, health information  exchanges report challenges in implementing practices that not only  enable the effective sharing of data but also ensure the appropriate use  and disclosure of personal health information. These factors may limit the  extent to which health care providers participate in electronic sharing of  their patients’ health information.
However, providers and patients have reported some benefits resulting  from the electronic sharing of health information, such as increased  patient safety, improved quality of health care, enhanced efficiency of  administrative functions, and reduced costs. Additionally, in a 2008 report  the Congressional Budget Office described benefits resulting from the  electronic sharing of personal health information, including decreases in  the duplication of diagnostic procedures and prevention of medical errors.
To promote the use of information technology for the electronic exchange  of personal health information among providers and other health care  entities, Congress passed the Health Information Technology for  Economic and Clinical Health (HITECH) Act as part of the American  Recovery and Reinvestment Act of 2009, which the President signed into  law on February 17, 2009. HITECH provides financial incentives, in the  form of grants and Medicare reimbursements, to promote the widespread  adoption of technology that supports the electronic sharing of personal  health information among health care entities, such as hospitals,  physicians, clinical laboratories, and public health agencies. In response to  the need to better define practices for ensuring that this information is  appropriately disclosed to authorized entities, the HITECH Act extends  existing federal privacy and security requirements to certain organizations,  such as health information exchanges, that facilitate the sharing of  electronic personal health information.
The HITECH Act requires us to report on practices implemented by health  information exchange organizations, providers, and other health care  entities for disclosing electronic personal health information. As agreed  with committee staff, our specific objectives were to describe the  practices implemented for disclosing personal health information for  purposes of treatment, including the use of electronic means for obtaining  consent, as reported by selected health information exchange  organizations, their participating providers, and other entities and the  effects of the electronic sharing of health information on the quality of  care for patients as reported by these organizations.
To address both objectives, we conducted case studies of 4 of more than  60 health information exchange organizations that were reported to be  operational. We also studied a selection of each of the exchanges’  participating providers that share information with other providers  through the exchange and directly with other providers (that are not  members of the exchange). These providers were identified by the  exchanges as active users of the HIEs’ services. In conducting the case  studies, we identified ways the exchanges and their participating providers  addressed selected disclosure practices, but we did not assess the  implementation of these practices. We also used the case studies to obtain  information on the effect that the electronic sharing of health information  had on the quality of care.
To supplement the information we collected through the case studies, we  gathered information from and conducted interviews with other health  care entities (two integrated health care delivery systems), two  professional associations (eHealth Initiative and Healthcare Information  Management and Systems Society), and one state’s electronic health  collaborative, an organization focused on developing and enforcing  statewide health information sharing policy. The information we obtained  through the case studies and from other entities about both disclosure  practices and quality of care cannot be generalized.
We conducted our work from May 2009 to February 2010 in accordance  with all sections of GAO’s Quality Assurance Framework that are relevant  to our objectives. The framework requires that we plan and perform the  engagement to obtain sufficient and appropriate evidence to meet our  stated objectives and to discuss any limitations in our work. We believe  that the information and data obtained, and the analysis conducted,  provide a reasonable basis for any findings and conclusions.
Appendix I contains further details about our scope and methodology,  including the methodology and criteria we applied in selecting health  information exchanges for our case studies.
subsections: section_title: Background
paragraphs: According to recent studies on the adoption of health information  technology, most health care providers in the United States still use  paper health records to store, maintain, and share patients’ information.  Sharing this information among multiple providers treating the same  patient requires transferring paper documents by mail, fax, or hand  delivery. In addition to being slow and cumbersome, these methods of  transferring health information can result in loss or late delivery of the  information, which may require the requesting provider to conduct  duplicate tests, or may contribute to medical errors due to the lack of  information needed to properly treat the patient. Additionally, the phys delivery of paper health records typically does not provide an effective  means for securing the information while it is being transferred, nor does it provide ways to identify who accesses the records or discloses the  information contained in the records.
In part to address these types of deficiencies, health care providers have  been adopting electronic health information systems to record, store, and  maintain patients’ information. As more providers have adopted and used  these systems, additional capabilities have been developed and  implemented, including the ability to electronically share patients’  information from a provider directly to other providers, or among  providers participating in an HIE.
HIEs facilitate the sharing of electronic health information by providing  the services and technology that allow providers (such as physicians,  hospitals, laboratories, and public health departments) to request and  receive information about patients from other providers’ records. For  example, when a provider requests information through the exchange, the  HIE identifies the source of the requested data, then initiates the  electronic transmission that delivers the data from the provider that is  disclosing the patient’s information to the provider that requested the  information. A simplified model of this exchange activity is shown in  figure 1.
Research indicates that most HIEs were formed to share information  among health care providers and organizations within a geographic area  (e.g., metropolitan area, state, region, or nation). However, others were  designed for unique purposes, such as to collect and share information  about participants involved in a state Medicaid program or to aggregate  information about patients within a community, state, or region in support  of efforts to improve the health of a population.
The ways that HIEs are established and managed vary. Some are  established by state governments, while others are established by private  organizations. They may be managed by public-private partnerships or  other organizations that were created to promote collaboration among  health care providers.
Efforts in the United States to establish organizations that facilitate the  sharing of electronic health information among providers began in the  early 1990’s. These organizations, called Community Health Information  Networks, evolved into Regional Health Information Organizations  throughout the early to mid 2000s. Since then, there has been a steady  increase in the number of HIEs that are fully operational and actively  facilitate the electronic sharing of patients’ health information. In 2007, the  eHealth Initiative reported that, in a nationwide survey, it had identified 32  operational HIEs. One year later, its survey identified 42 operational  exchanges, representing a 31 percent increase. Then, in 2009, the survey  identified 57 operational exchanges, a nearly 36 percent increase from  2008.
Most of the nearly 150 exchanges that responded to the eHealth Initiative’s  2009 survey reported that they were not yet engaged in the electronic  exchange of health information but were involved in activities such as  defining a business plan, identifying participants’ information  requirements, and securing funding. Others responded that they were in  the process of defining and implementing technical, financial, and legal  procedures. The 57 operational HIEs that responded to the survey  reported that they support a variety of information-sharing services for  their participating providers. The most common services included the  delivery of laboratory and test results and clinical documentation,  electronic health records, electronic prescribing, and alerts about critical  conditions, such as adverse drug interactions. Other services included data  sharing for public health purposes, such as for tracking and managing  childhood immunizations, and for reporting health care quality measures  to participating providers.
subsections: section_title: Widely Accepted Privacy Practices Provide a Framework for Protecting Electronic Personal Health Information
paragraphs: The United States and several other countries base privacy laws and  policies on practices for protecting personal information, including health  information. While there is no single federal law in the United States that  defines requirements for protecting electronic personal health information  from inappropriate use or disclosure, there are a number of separate laws  and policies that provide privacy and security protections for information  used for specific purposes or maintained by specific entities. Further,  some states impose additional restrictions on the use and disclosure of  personal health information through state laws and regulations, while  others do not define restrictions beyond those imposed by federal rules.
subsections: section_title: Fair Information Practices
paragraphs: Privacy experts refer to a set of basic principles, known as Fair  Information Practices, as a framework for protecting personally  identifiable information such as personal health information. These  practices were first proposed in 1973 by a U.S. government advisory  committee. The practices provided the basis for subsequent laws and  policies in the United States and other countries. While there are  different versions of Fair Information Practices, their core elements are  reflected in the privacy and security regulations promulgated under the  Health Insurance Portability and Accountability Act of 1996 (HIPAA), and  in the seven key practices that we addressed with the case study HIEs and  providers. They are described in table 1.
The HIPAA Privacy and Security Rules define the circumstances under  which personal health information may be disclosed by covered entities  to other entities, such as providers, patients, health plans (insurers), and  public health authorities. The HIPAA Privacy Rule places certain  limitations on when and how covered entities may use and disclose  personal health information. However, the Privacy Rule permits the use or  disclosure of personal health information for treatment, payment, and  other health care operations. To ensure that this information is reasonably  protected from unauthorized access, the HIPAA Security Rule specifies a  series of administrative, technical, and physical security practices for  providers and plans to implement to ensure the confidentiality of  electronic health information.
section_title: Health Information Technology for Economic and Clinical Health Act
paragraphs: The HITECH Act includes a series of privacy and security provisions that  expand certain provisions under HIPAA. Although final regulations for  implementing these provisions remain under development, HITECH  requires certain entities that were not initially covered by HIPAA, which  may include health information exchanges, to meet the requirements  defined in the HIPAA privacy and security rules. Further, if certain  conditions are met, the act may limit the disclosure of information to  health plans (insurers) upon patient request. HITECH also provides an  individual with a right to receive an accounting of disclosures of patient  information (for the purposes of treatment, payment, and health care  operations) from covered entities using electronic health records.
section_title: HIEs and Providers Describe Various Methods of Implementing Disclosure Practices
paragraphs: The four exchanges in our case studies reported that they implement  various practices to ensure appropriate disclosure of electronic personal  health information for treatment purposes. The 18 case study providers  that participate in these exchanges also described practices they  implement for disclosing patients’ personal health information when the  information was shared through an HIE or directly with other providers.  Some of the providers reported that they inform patients that their  electronic personal health information may be shared through a health  information exchange. The practices reported by the HIEs and providers  reflect the seven Fair Information Practices that we described. In all cases,  the providers we studied stated that their participation in an HIE did not  require them to change their established practices for disclosing and  safeguarding patients’ personal health information.
While providers take responsibility for implementing the three practices  that involve direct contact with patients (providing information about and  obtaining consent for use and disclosure, and making corrections to  personal health information), both providers and exchanges share  responsibility for implementing the other four practices. For example, the  18 case study providers inform their patients about the use of personal  health information by giving notices of privacy practices and by other  means. They also obtain patients’ consent to disclose health information  for purposes of treatment, payment, and operation. Additionally, providers  stated that they implement practices to facilitate patients’ ability to access  and request corrections to personal health information, and all the HIEs  and providers described practices intended to limit the disclosure and use  of information to specific purposes. They also described practices they  implement that are intended to address security, data quality, and  accountability for protecting electronic personal health information.  Detailed information about the privacy practices identified by our case  study organizations is included in appendix II.
subsections: section_title: Providers Reported That They Inform Patients about the Use of Their Information and How It Is to Be Protected, but Most Do Not Inform Patients about Sharing through an HIE
paragraphs: All of the 18 providers in our case studies inform their patients of their  overall privacy practices by giving them a notice in paper form, and 13 of  them post a copy of the notice on their Web site. These notices state that  the provider intends to use and disclose patients’ personal health  information for treatment purposes, explain the provider’s commitment to  protect that information and how it intends to do so, and inform patients  about their right to take action if they believe their privacy has been  violated.
Six of the case study providers stated that they inform patients by various  methods that personal health information will be shared with other  providers through an HIE. Three of the six providers include this  information in the paper privacy notices that they give to patients, and  three providers use other methods to inform patients of their participation  in an HIE. For example, two providers inform patients by displaying  materials, such as posters, in the waiting room. Another informs patients  that their information will be shared electronically when obtaining consent  to disclose information for treatment purposes.
section_title: Providers Reported Various Methods of Obtaining Patients’ Consent for Sharing Personal Health Information, but None Has Implemented Electronic Consent
paragraphs: As with giving notice, all case study providers that treat patients stated  that they obtain and document patients’ consent for disclosure, most often  doing so by having patients sign paper forms that include language  authorizing the disclosure of personal health information for treatment,  payment, and health care operations. However, the 15 providers that  send patients’ information to other providers through an HIE described  varying approaches for obtaining patients’ consent. For example, 14 of  the providers rely on patients’ general consent; 8 of the 14 do not give  patients an option to exclude their health information from the HIE. Six  case study providers assume patients are willing to have their information  shared through an exchange unless this consent is explicitly denied. The  other one of these 15 providers actively seeks patient consent to share  information through the exchange before it allows such sharing to take  place. The practice of obtaining patients’ consent for sharing their  information through an HIE is intended to help ensure that patients are  aware of how and with whom their information is being shared.
None of the case study providers had implemented electronic means for  obtaining patients’ consent for disclosure. However, one HIE had  developed an electronic tool that its providers use to record patients’  consent preferences that are obtained by other means.
section_title: Providers Reported That They Implement Similar Methods to Facilitate Patients’ Access to Their Personal Health Information and to Request Corrections
paragraphs: Allowing patients to review their personal health information and request  corrections to their records helps ensure that patients have a way to verify  the accuracy and integrity of their personal health information. Seventeen  of the 18 providers in our case studies reported that they require patients  to request access to their information in writing and to then view or obtain  their information in person. In most cases, providers require patients to  submit a written request for a correction. The correction is included in the  patients’ records after a doctor determines that it is appropriate. One  provider allowed patients to use a Web portal to view the demographic  and medical information in their files and to request changes to that  information.
Once a correction to a patient’s record has been made by a provider, it  may be difficult to ensure that the same correction is made in the records  of other providers with whom the patients’ information has been  previously shared through an HIE. While the case study exchanges are not  directly involved with patients’ requests, two reported that they help  providers remain up-to-date with patients’ corrected records. For example,  these exchanges stated that they generate reports that identify where  patient information has been shared. Providers can use this information to  notify other providers about corrections and better ensure that the  patient’s information remains consistent and up-to-date with all providers.
section_title: HIEs and Providers Described Similar Practices for Limiting Disclosure with Exceptions for Emergency Situations
paragraphs: The four HIEs and 18 providers also described steps they take to limit the  use of personal health information to specific purposes. All of the  exchanges and providers reported that they limit disclosures by  implementing role-based access controls through their systems. For  example, HIEs and providers generally grant individuals involved in  treating patients, such as physicians and nurses, access to all patient  information, while those whose roles are limited to administrative  functions (e.g., scheduling appointments) are provided access only to  information relevant to those functions, such as patient demographics.  Further, two of the exchanges limit the amount and types of patient  information shared with their participating providers to certain types of  data, such as those specified in standard continuity of care documents or  in summary reports defined by the HIEs and their participating providers.  Fifteen providers stated that when they receive requests for a patient’s  information directly from other providers (that do not participate in the  HIE), they examine requests on a case-by-case basis. Based on the  examinations, these providers limit disclosure to the data they determine  is appropriate to address the purpose of each request. By taking these  steps, the case study exchanges and providers intend to limit sharing of  electronic personal health information to specific purposes and to protect  this information from inappropriate use and disclosure.
While HIEs and providers described ways that they limit the disclosure of  information in ordinary circumstances, three of the exchanges also  reported that they have provisions for allowing special access to  electronic information in emergency situations. All the exchanges in our  study allow authorized emergency department physicians full access to  data for patients they treat. One also allows providers broader access to  patient information for some non-emergency situations, such as when  obtaining historical information about new patients. In those cases, users  are able to access data on any patient by providing a justification for the  need to access the information. By allowing access to the electronic  information about patients that they have stored in their health  information systems, the HIEs support the providers’ ability to provide  care to new patients and to patients in emergency situations.
HIEs and providers said that they limit disclosure of patient information  for uses other than treatment—i.e., secondary uses—to the purposes  allowed by the HIPAA Privacy Rule. Specifically, the rule allows reporting  de-identified health data to public health agencies for purposes such as  disease tracking and sharing health information with medical research  facilities. However, representatives from one case study HIE described  an additional secondary use of the personal health information for a  quality improvement program that it conducts. This exchange analyzes  participating providers’ overall performance based on specific indicators  (e.g., performing mammograms, screening for diabetes, and providing well  checks for children and infants) and compares their performance to that  of other providers that treat similar patient populations. By showing  providers how they compare to their peers in providing chronic care  treatment and preventive care to patients, these reports encourage  providers to match their performance with that of their peers.
section_title: HIEs and Providers Reported Various Methods of Securing Patients’ Personal Health Information against Improper Use and Disclosure
paragraphs: In addition to the steps they take to limit the disclosure of personal health  information, HIEs and providers described practices they implement for  securing patients’ electronic personal health information against misuse  and inappropriate disclosure. These practices include mechanisms  intended to limit access to health information systems and patients’ data  that are stored in these systems, and to secure data during transmission.
All the case study HIEs and providers reported that they register and  approve users before they are allowed access to their systems (i.e., the  HIEs’ information systems and the providers’ own internal health  information systems). They require users to log in to the systems with  unique user names and passwords that were established during  registration. In addition, two of the exchanges and five providers reported  that they take more rigorous steps for verifying users’ identities. For  example, one exchange implemented a two-stage login process that  requires users to identify pictures that they select during registration in  addition to confirming the user’s name and password. In two cases,  providers’ systems require the entry of an additional code generated by a  security token before allowing users to log in from a remote location (i.e.,  a location other than the place of employment).
HIEs also described additional steps they take to restrict access to  patients’ personal health information. For example, one requires providers  to enter patient identification information when requesting data from  other providers’ records; this practice is intended to restrict providers’  access to data about patients they are treating at the time of the request.  Another limits the time period for which a provider can access a patient’s  information—i.e., providers can only access information for a 90-day  treatment period. One of the exchanges described a role-based method it  had implemented for restricting access to system data. In this case, the  system requires and verifies additional information about the requester  before allowing access to certain data stored in the system. By restricting  access to the systems in which patient information is stored and to only  the information needed by providers for treating a patient, HIEs intend to  protect the personal health information that they maintain in their systems  from access by unauthorized individuals.
In addition to access control mechanisms, HIEs and their participating  providers reported that they implement a combination of practices to  ensure that the data they store are secure. The HIEs in our case studies  reported that they intend to store all electronic patient data indefinitely to  accommodate legal requirements and varying data retention  requirements. Most HIEs stated that they store detailed personal health  information on patients, although the types and amount of stored data  varies. For example, two of the exchanges store all patient health  information that is sent from participating providers. Representatives of  two other exchanges reported that they do not provide a repository for  personal health information but retain limited information, such as (1)  demographic information used to identify the patient, including the  patient’s name and date of birth; (2) identifying information used to locate  patients’ records when users search for data; and (3) data for maintaining  an audit trail of access and use of patients’ personal health information.  These HIEs described technical safeguards they implement for protecting  the data that they store, such as the use of virtual private networks,  firewalls, and intrusion detection systems. Providers reported that they  implement similar security mechanisms to protect the electronic personal  health information that they store.
Additionally, all the exchanges and ten of the providers reported that they  implement practices for securing personal health information that is  transmitted electronically to an HIE or other providers. They stated that  the data that they share electronically are encrypted prior to the data  being transmitted. The implementation of these mechanisms is intended to  prevent unauthorized individuals from accessing data being stored or  transmitted for misuse, such as exploitation of confidential information for  monetary gain or health identity theft.
section_title: HIEs and Providers Described Steps They Take to Ensure That Shared Patient Data Are Accurate and Complete
paragraphs: To ensure that the information they share about patients is accurate and  complete, the HIEs and providers stated that they conduct testing and  other activities to verify the quality of their data. Specifically, all the  exchanges stated that they perform data quality testing prior to  incorporating providers’ data into their systems. This testing entails the  use of automated tools to verify that patients and data are matched  accurately, along with manual reviews of data performed by personnel  within the HIE. However, all of the exchanges generally rely on their  participating providers to ensure the accuracy and completeness of  patients’ personal health information; they stated that their responsibility  is limited to maintaining the quality of the data as it is received from and  transmitted to providers.
In addition, providers described practices for ensuring the quality of  patient data that they maintain in their own health information systems  and share through HIEs. For example, 13 of the providers told us that they  conduct manual or automated data review processes similar to those  described by the exchanges. By reviewing and testing data prior to  integrating patients’ health information into electronic information  exchange systems, the case study HIEs and providers are taking steps to  ensure that the providers with which they exchange electronic personal  heath information receive accurate and complete data about their patients.
section_title: HIEs and Providers Reported Similar Steps They Take to Establish Accountability for the Protection of Personal Health Information
paragraphs: The HIEs in our study described steps they take to hold individuals  accountable for protecting patients’ personal health information. All four  exchanges stated that policies and procedures for the appropriate  disclosure of health information and consequences for improper use of  personal health information are included in agreements that HIEs  establish with their participating providers prior to initiating health  information sharing activities. Specifically, exchanges described  potential consequences for misuse of data by their participating providers  and their employees, including suspending system access, terminating  employment, and prosecuting criminal activities. All the case study  exchanges stated that they maintain system access logs, which are  reviewed periodically to identify inappropriate use or disclosure of data .  Further, one exchange reported that its security officer performs reviews of providers’ internal security and privacy policies and procedures to  ensure that minimum protections are in place, such as mechanisms fo obtaining patients’ consent to share information, and that practices meet  legal requirements.
section_title: HIEs, Providers Other Entities Reported Examples o Ways the Electroni Sharing of Health Information Has a n Positive Effect o Quality of Care
paragraphs: Although the exchanges stated that they had not conducted formal studie of the effects of electronic sharing of personal health information on the  quality of care their providers deliver, three of the HIEs repo of positive effects resulting from the services they provide.
One of the exchanges reported that it provides alerts and reminders to  participating providers regarding the health care of their patients, which can result in more timely interventions. An official from this exchange  described one instance whereby a physician was reminded that seven of  ived  his patients needed colonoscopies based on exchange alerts he rece for each patient. Because of these alerts, the physician notified the  patients, and they received this procedure. Results of the tests identified  ation about three of the patients, and they were  important clinical inform able to begin treatment.
Two of these three exchanges provide a direct connection from  participating hospitals to the state’s Department of Public Health for re time reporting of conditions and for supporting the early detection of  disease outbreaks. According to an official with one of these exchanges,  this service facilitated the state’s ability t f H1N1 more quickly than other states.  oo obtain information about cases    Another exchange provides physicians with quality indicator reports basedon clinical results from all participating institutions and physicians across the community. Specifically, physicians can create individualized report s  based on patients for whom they are  listed as the primary care physician r specific quality indicators, such as determining which patients have  fo had a Pap smear in the last 3 years.
While none of the HIEs has conducted formal studies or otherwise  evaluated the overall effect of the electronic sharing of health information  of care, three of them discussed plans to study the effect of  on the quality the electronic sharing of health information on specific aspects of health  care quality.
One exchange reported that it has started working with a local public  health department to develop metrics based on prevalent health  conditions in the community, such as the percentage of each provider’s  patients that have appropriate immunizations and the percentage of  eligible patients that have had mammograms or other tests to screen for  cancer. The exchange plans to aggregate some of its data to track these  metrics and to study whether and how monitoring these metrics impacts  the quality of care. An official at this HIE said that they intend to begin this  initiative in 2010, but doing so is dependent on available funding.
Another exchange reported that it initiated a quality improvement progra in March 2009 that is intended to help physicians adhere to evidence-bas medical practices to improve the health of their patients and to promote  patient satisfaction. According to officials, this program merges  claims  data from health plans and clinical data from hospitals, laboratories, an physicians’ offices. These data are used for metrics that target  preventative care services and chronic disease management, including  cancer screening, diabetic testing, and medications for those with asthma Officials from this exchange stated that they ha o were not able to provide us with a time frame. .  ve plans to study the effect  f this program on the quality of care, but at the time of our review, they    A third HIE said that it has developed a plan to conduct an overall  evaluation that will include analyzing how the electronic exchange of  health information affects the quality of care, such as determining wheth providers’ use of the exchange has reduced the time it takes a provider to  diagnose a patient because of easier access to information. Surveys and  focus groups of providers who use data will be used to evaluate the effect  of the exchange on the quality of care. Officials stated that they anticipate  beginning this evaluation in 2010. er  Additionally, the participating providers in our study—all of whom wer e  identified as active users of an exchange—reported that, because they ar part of an HIE, they have had more comprehensive and timely patient  health information available at the point of care, which they believe has  had a positive effect on the quality of care. Providers said that they can access information about their patients through their exchange that is no otherwise available in their own records, including information about  medications and test results obtained from other providers, which gives  them more comprehensive information about the status of their patient health. Additionally, providers save time by obtaining patients’ informati from the exchange rather than by contacting other providers by fax or  mail, or by repeating tests that other providers have already conducted,  allowing for more timely information at the point of care. Some pr also told us that they use the HIE to obtain patient laboratory results more  quickly than by the traditional methods of mail or fax, which has  facilitated earlier intervention for patients. Participating providers gave us  these additiona through the exchange as having a positive effect on the quality of care for  their patients:  l examples of how they saw the information obtained    A large hospital reported that physicians in the emergency department  on information about patients, such  s information about patients’ medication allergies, to identify and avoid  have used the HIE to obtain medicati a potential adverse drug interactions.
A medium-sized hospital stated that information obtained through the HIE helped their emergency department physician ascertain that a patient who was requesting medication for pain had been in five area hospitals in seven  nights seeking pain medication. The physician did not prescribe any pain  medication for the patient.
A small physician’s practice and a large hospital reported that information available through the exchange facilitates the transfer of patients. Hospita officials said that by having immediate access to information on patients  transferred to them, physicians can begin to develop treatment plans for  the patient earlier, resulting in more timely care. Also, because they have  a not end up repeating tests that have already been performed. ccess to the patients’ test results, physicians at the receiving facility do    A participating physician from a family practice clinic reported that HIE provided valuable information about a patient who had left the  hospital before being treated. Information about this patient in the  exchange revealed that emergency department physicians had been trying  itial signs of a  to reach the patient because he had been experiencing the in  the  heart attack. As a result of having this information, the physician sent thi patient back to the hospital to be treated for cardiac arrest.
Officials at a participating public health department stated that they use  information obtained through the HIE to maintain their immunization and exam records for children, including exams that screen for vision, hear nutrition, or other issues. The officials reported that this information has  h private physicians, who may also conduct exams for these children. elped to eliminate duplication of exams by the health department or    A large hospital from one of the exchanges reported that their cardio was able to obtain an abnormal laboratory result electronically  exchange one day before they would have without using it, allowing  earlier intervention for a potentially life-threatening condition.
Two of the other entities we interviewed—integrated health care delivery  systems that share information within their own systems—reported that  they have joined or have considered joining an HIE to obtain more  comprehensive information about their patients, who may obtain health  care services from providers outside of their systems. Officials with one of  the integrated health care systems said that they joined an exchange  recently because they felt it would provide physicians and other health  care providers with a more complete picture of a patient’s health  information regardless of where the patient obtains care, which could help  to eliminate unnecessary or duplicative care, including tests that may have  already been performed by other providers. Officials from the second  integrated health care delivery system told us that they were considering  joining an exchange because it could provide them with information about  care—such as medications prescribed—obtained from providers outside  of their system. In addition, these officials noted that joining the exchange  could benefit emergency department physicians by helping them obtain  immediate, more comprehensive information about patients.
If you have any questions on matters discussed in this report, please  contact me at (202) 512-6304, Gregory C. Wilshusen at (202) 512-6244, or  Linda T. Kohn at (202) 512-7114, or by e-mail at melvinv@gao.gov,  wilshuseng@gao.gov, or kohnl@gao.gov.
Contact points for our offices of Congressional Relations and Public  Affairs may be found on the last page of this report. Other contacts and  key contributors to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to describe (1) the practices implemented for  disclosing personal health information for purposes of treatment,  including the use of electronic means for obtaining consent, as reported by  selected health information exchanges, their participating providers, and  other entities; and (2) the effects of the electronic sharing of health  information on the quality of care for patients as reported by these  organizations.
To address both objectives, we conducted case studies of selected health  information exchanges and their participating providers. We selected four  operational health information exchanges and a sample of participating  providers for each of the four exchanges. To select the case study health  information exchanges, we compiled a list of 68 health information  exchanges that were reported to be operational and actively sharing data  among providers. From this list, we selected a judgmental, non- generalizable sample of four exchanges. Each exchange we selected met  two of the following three characteristics:    had an interstate data exchange and the need to address different state  laws and regulations applicable to the disclosure of protected health  information; included varying numbers, sizes, and types of provider organizations that  disclose health information through the exchange; and   operated with some degree of state involvement such as a state-led or  state-level health information exchange.
To identify exchanges with the selected characteristics, we reviewed our  prior reports, and reports on outcomes of relevant Department of Health  and Human Services projects such as the Nationwide Health Information  Network, the State-level Health Information Exchange Consensus Project,  and the Health Information Security and Privacy Collaboration. We also  reviewed published research identifying active health information  exchanges and relevant policy issues, and research published by health  information technology professional associations and other health  information privacy experts having data and knowledge about active  health information exchange organizations. Finally, we considered the  geographic location of the exchanges when making our final selection.
We worked with each health information exchange to select a judgmental  sample of participating providers. The categories of providers we used to  ensure that we would have a variety in our sample included:    small and medium hospitals with 199 beds or fewer;  large hospitals with 200 beds or more;   small physician practices with fewer than 10 full-time equivalent  large physician practices that have 10 or more full-time equivalent  employees; and   other types of organizations, including long-term care facilities, public  health facilities, pharmacies, laboratories, and insurance plans.
We were unable to include all categories of participating providers for  each exchange in our sample because some exchanges did not include  providers from each category. We studied various types of providers that  were active users of health information exchanges and that shared  information directly with other providers (that are not members of the  exchange). Because each health information exchange defined parameters  for and tracked usage of the exchanges differently, we relied on officials  from each exchange to identify providers from each category that were  active users of the HIE’s services.
For each of the four case studies, we    gathered documentation and conducted interviews with the exchanges to  determine the practices they implemented for disclosing personal health  information, including electronic means of obtaining consent, practices  they required for participating providers, and reported effects of sharing  health information electronically on the quality of care; and    gathered documentation and conducted interviews with officials from  selected participating providers to determine the practices they  implemented as part of the health information exchange and the practices  they had implemented in their own organization for disclosing personal  health information. In addition, we interviewed officials from these  participating providers to determine how and to what extent the electronic  sharing of health information affected the quality of care.
At the conclusion of our study, we validated the information that we  included in this report with the exchanges and providers to confirm that  their disclosure practices and examples of the effects of electronic sharing  of personal health information were accurately portrayed. While we did  not independently test the reported practices and examples of effects on  quality of care, we corroborated the testimonial evidence obtained during  our case studies with supporting documentation.
For additional information about the health information exchanges and  participating providers we studied, see appendix II.
To supplement the information we obtained from our case studies, we  gathered information from and conducted interviews with other entities,  including two integrated health care delivery systems. We also held  discussions with two professional associations (eHealth Initiative and  Healthcare Information Management and Systems Society) and 11 of their  affiliated health information exchanges, and the New York eHealth  Collaborative, an organization focused on developing and enforcing New  York State’s health information exchange policy. We interviewed and  obtained additional information from other health care organizations,  including the American Hospital Association, the Agency for Healthcare  Research and Quality, the American Medical Association, and the Center  for Studying Health System Change. Additionally, we reviewed federal  requirements for protecting electronic personal health information,  accepted privacy guidelines produced by the Organization for Economic  Cooperation and Development and the Markle Foundation’s Connecting  for Health Collaborative, and reports and guidance on implementing  privacy practices produced by the Department of Health and Human  Services’ Office for Civil Rights and Office of the National Coordinator for  Health Information Technology. We also interviewed privacy experts from  the Health Policy Institute at Georgetown University and the World  Privacy Forum.
We conducted our work from May 2009 to February 2010 in accordance  with all sections of GAO’s Quality Assurance Framework that are relevant  to our objectives. The framework requires that we plan and perform the  engagement to obtain sufficient and appropriate evidence to meet our  stated objectives and to discuss any limitations in our work. We believe  that the information and data obtained, and the analysis conducted,  provide a reasonable basis for any findings and conclusions.
section_title: Appendix II: Case Studies
paragraphs: Case Study 1 was of a health information exchange (HIE) serving a  metropolitan area and a neighboring state. The HIE was organized in 1995  by a private company and has supported the exchange of health  information among providers in its metropolitan area and neighboring  state since 2006. For this case study, we identified disclosure practices  reported by the HIE, two of its participating hospitals, and three provider  practices.
Providers participating in the exchange  Other (e.g., clinical laboratories, long-term care facilities,  hospices, etc.)
The tools and services offered by this HIE include:    Delivery of results to providers via an online inbox (e.g., laboratory test  results)
Communications (e.g., messaging for sending, receiving and managing  information about patients among providers)
Access by emergency department physicians to clinical history from all  participating providers for patients being treated in emergency  departments    Electronic health record system for providers opting to store their patient  records with the HIE instead of in internal systems    Assistance to providers with technology implementation and training as  well as provider-specific analysis of patient data for quality review  purposes Table 1 describes the methods of implementing disclosure practices  reported by the HIE and the five participating providers that we studied.
Case Study 2 was of an HIE that serves multiple states. The HIE is led by  a nonprofit organization and supports regional level information exchange.  Organized in 2005, this HIE began actively exchanging data among its  participating providers in 2008. For this case study, we identified  disclosure practices reported by the HIE, a hospital, two provider  practices, and a public health department.
Providers participating in the exchange  Other (e.g., health plan, public health department)
The tools and services offered by the HIE include:    Communications (e.g., receiving and managing information about patients  among providers)
Interface to support searching for patient data by providers and presenting  data in a standard summary medical record format   Assistance to providers with technology implementation and training as  well as provider-specific analysis of patient data for quality review  purposes  Table 2 describes the methods of implementing disclosure practices  reported by the HIE and the four participating providers that we studied.
Case Study 3 was of an HIE serving one state. Operated by a public- private partnership, the exchange was created by state statute in 1997 and  began supporting the exchange of health information among providers in  May 2007. The participating providers selected for review as part of this  case study included two hospitals and two provider practices.
Providers participating in the exchange  Provider practices (e.g., private physician practices, health  centers, hospital emergency departments, clinics)
Other (e.g., two national clinical laboratories, pathology provider)
The tools and services offered by this HIE include:    Secure delivery of clinical results in a standardized format (e.g., laboratory  test results), reports (e.g., radiology), and face sheets (demographic and  billing information)
Enhanced provider-to-provider communication (e.g., forwarding clinical  results to HIE users’ inbox)
Interface to support searching for patient data in electronic health record  for those providers with them Interface for public health reporting and biosurveillance activities Table 3 describes the methods of implementing disclosure practices  reported by the HIE and the four participating providers that we studied.
Case Study 4 was of an HIE serving one state. The HIE was established  as a public-private partnership led by a nonprofit organization in 2004.  It supports state-level information exchange and began actively  exchanging data amongst its participating providers in 2007. For this case  study, we identified disclosure practices reported by the HIE, two  hospitals, a physician practice, and two clinics.
Providers participating in the exchange  Other (e.g., clinics and state and local health departments)
The tools and services offered by this exchange include:    Delivery of results to providers (e.g., laboratory test results)
Communications (e.g., messaging for sending, receiving and managing  information about patients among providers)
Automatic delivery of patients’ clinical history from all participating  providers to emergency departments when patients are registered   Quality metrics based upon analysis of provider data for key indicators  (e.g., mammograms provided to patients for whom they are indicated)
Interface to support reporting by hospitals of reportable conditions and  emergency department chief complaint data to state health department  Table 4 describes the methods of implementing disclosure practices  reported by the HIE and five of its participating providers that we studied.
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: In addition to the contacts named above, key contributors to this report  were Bonnie W. Anderson (Assistant Director), John A. de Ferrari  (Assistant Director), Teresa F. Tucker (Assistant Director), Monica Perez  Anatalio, Danielle A. Bernstein, April W. Brantley, Susan S. Czachor, Neil J.  Doherty, Rebecca E. Eyler, Amanda C. Gill, Nancy E. Glover, Ashley D.  Houston, Fatima A. Jahan, Thomas E. Murphy, and Terry L. Richardson.