Prescription Drug Data: HHS Has Issued Health Privacy and Security Regulations but Needs to Improve Guidance and Oversight
Published: 2012-06-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Prescribing medications and filling those prescriptions increasingly relies on the electronic collection of individuals health information and its exchange among health care providers, pharmacies, and other parties. While this can enhance efficiency and accuracy, it also raises privacy and security concerns. Federal law establishes the authority for the Secretary of HHS to develop standards for protecting individuals health information (which includes Medicare beneficiaries) and to ensure that covered entities (such as health care providers and pharmacies) and their business associates comply with these requirements.
The Medicare Improvements for Patients and Providers Act of 2008 required GAO to report on prescription drug use data protections. GAOs specific objective for this review was to determine the extent to which HHS has established a framework to ensure the privacy and security of Medicare beneficiaries protected health information when data on prescription drug use are used for purposes other than direct clinical care. To do this, GAO reviewed HHS policies and other related documentation and interviewed agency officials.
section_title: What GAO Found
paragraphs: While the Department of Health and Human Services (HHS) has established a framework for protecting the privacy and security of Medicare beneficiaries prescription drug use information when used for purposes other than direct clinical care through its issuance of regulations, outreach, and enforcement activities, it has not issued all required guidance or fully implemented required oversight capabilities. HHS has issued regulations including the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules to safeguard protected health information from unauthorized use and disclosure. Through its Office for Civil Rights (OCR), HHS has undertaken a variety of outreach and educational efforts to inform members of the public and covered entities about the uses of protected health information. Specifically, OCR has made available on its website guidance and other materials informing the public about the uses to which their personal information may be put and the protections afforded to that information by federal laws. It has also made available guidance to covered entities and their business associates that is intended to promote compliance with the HIPAA Privacy and Security Rules.
However, HHS has not issued required implementation guidance to assist entities in de-identifying personal health information including when it is used for purposes other than directly providing clinical care to an individual. This means ensuring that data cannot be linked to a particular individual, either by removing certain unique identifiers or by applying a statistical method to ensure that the risk is very small that an individual could be identified. According to OCR officials, the completion of the guidance, required by statute to be issued by February 2010, was delayed due to competing priorities for resources and internal reviews. Until the guidance is issued, increased risk exists that covered entities are not properly implementing the standards set forth by federal regulations for de-identifying protected health information.
Additionally, in enforcing compliance with the HIPAA Privacy and Security Rules, OCR has established an investigations process for responding to reported violations of the rules. Specifically, the office annually receives thousands of complaints from individuals and notices of data breaches from covered entities, and initiates investigations as appropriate. If it finds that a violation has occurred, the office can require covered entities to take corrective action and pay fines and penalties.
HHS was also required by law to implement periodic compliance audits of covered entities compliance with HHS privacy and security requirements; however, while it has initiated a pilot program for conducting such audits, it does not have plans for establishing a sustained audit capability. According to OCR officials, the office has completed 20 audits and plans to complete 95 more by the end of December 2012, but it has not established plans for continuing the audit program after the completion of the pilots or for auditing covered entities business associates. Without a plan for establishing an ongoing audit capability, OCR will have limited assurance that covered entities and business associates are complying with requirements for protecting the privacy and security of individuals personal health information.
section_title: What GAO Recommends
paragraphs: GAO recommends that HHS issue de-identification guidance and establish a plan for a sustained audit capability. HHS generally agreed with both recommendations but disagreed with GAOs assessment of the impacts of the missing guidance and lack of an audit capability. In finalizing its report, GAO qualified these statements as appropriate.

section_title: Letter
paragraphs: The increasing reliance on electronic processes to deliver health care  services has the potential both to improve the quality of care received by  patients, including Medicare beneficiaries, and reduce costs. In particular,  the process of prescribing medications and filling prescriptions  increasingly relies upon the electronic transmission of patient information  among health care providers, pharmacies, and other entities. This can  make the prescription process more efficient and accurate; however, the  transmission and sharing of individuals’ personal information raises  concerns about protecting the privacy and security of that information.
The capacity of organizations that exchange health information to store  and manage a large amount of electronic health information also  increases the risk that a breach in security could expose the personal  health information of numerous individuals. In recent years, a number of  entities—including health plans, hospitals, universities and medical  centers—have reported the loss or theft of large amounts of sensitive  personal information, such as health information. Such compromises can  leave personal health information vulnerable to inadvertent or deliberate  misuse, loss, or improper disclosure. For example, the Department of  Health and Human Services (HHS) reported that more than 5.4 million  individuals were affected by a breach of their personal health information  in 2010. While information technology can provide the means to protect  the privacy of electronically stored and exchanged health information, the  increased risk of inappropriate access and disclosure heightens the  importance of implementing adequate privacy protections and security  mechanisms in health information exchange systems.
The Medicare Improvements for Patients and Providers Act of 2008  (MIPPA) requires us to report, by September 1, 2012, on prescription  drug use data protections. As agreed with committee staff, our specific  objective for this report was to determine the extent to which HHS has  established a framework to ensure the privacy and security of Medicare  beneficiaries’ protected health information when data on prescription drug  use are used for purposes other than their direct clinical care.
To determine the extent to which HHS has established a framework to  ensure the privacy and security of protected health information, we  identified the department’s responsibilities by reviewing and analyzing the  Health Insurance Portability and Accountability Act of 1996 (HIPAA), and  its implementing regulations, the Privacy and Security Rules; the Health  Information Technology for Economic and Clinical Health Act (HITECH  Act); and applicable privacy best practices, such as the Fair Information  Practices. To obtain information on the efforts of the department’s Office  for Civil Rights (OCR) in implementing HIPAA’s and the HITECH Act’s  requirements, we reviewed and analyzed documentation related to OCR’s  public outreach and guidance efforts, enforcement practices, and HHS  rulemakings regarding covered entity and business associate  responsibilities and compared those documents to statutory  requirements. Further, we interviewed officials from the Centers for  Medicare and Medicaid Services (CMS), the Office of the National  Coordinator for Health Information Technology, and OCR. To determine  the uses of prescription drug use data and the risks associated with the  uses of prescription drug data for purposes other than direct clinical care,  we interviewed representatives from several covered entities and medical  associations, and reviewed academic publications.
We conducted this performance audit from August 2011 through June  2012 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. Our objective, scope, and  methodology are discussed in more detail in appendix I.
subsections: section_title: Background
paragraphs: According to HHS, widespread use of health information technology could  improve the quality of care received by patients and reduce health care  costs. One such technology, electronic prescribing, can be used, for  example, to electronically transmit a prescription or prescription-related  information between a health care provider and a pharmacy or to provide  other technological capabilities, such as alerting a provider to a potential  interaction between a drug and the patient’s existing medications.
In traditional, or paper-based, prescribing, health care providers that are  licensed to issue prescriptions for drugs (e.g., physicians or others  licensed by the state) write a prescription, and calling it into or have the  patient take that prescription to a dispenser (e.g., pharmacy) to be filled.  In contrast, use of an electronic prescribing system consists of a licensed  health care provider using a computer or hand-held device to write and  transmit a prescription directly to the dispenser. Before doing so, the  health care provider can request the beneficiary’s eligibility, formulary,  benefits, and medication history. Figure 1 illustrates an example of the  flow of information during the electronic prescribing process.
In order to transmit a prescription electronically, multiple entities need to  have access to an individual’s identifiable health information in an  electronic format. Federal laws and regulations dictate the acceptable use  and disclosure activities that can be performed with individually  identifiable health information, defined as protected health information  (PHI). These activities include treatment, payment, health care  operations, and—provided certain conditions are met—public health or  research purposes. For example, electronic health information can be  held by covered entities that perform treatment functions for directly  providing clinical care to a patient through electronic prescribing. These  covered entities and business associates, such as medical professionals,  pharmacies, health information networks, and pharmacy benefit  managers, work together to gather and confirm patients’ electronic health  information for prescribing, such as a beneficiary’s eligibility, formulary,  benefits, and medication history. To electronically transmit prescription  drug data between a health care provider and a pharmacy, an electronic  health record can be used to obtain information about the health of an  individual or the care provided by a health practitioner.
In both paper-based and electronic prescribing, information is also  provided to the individual’s health plan for payment, which would include  the identification of the beneficiary, the pharmacy, and the drug cost  information. In the case of Medicare beneficiaries’ prescription drug data,  the information is provided to CMS for Part D payment calculations.  Every time a beneficiary fills a prescription under Medicare Part D, a  prescription drug plan sponsor must submit a summary record called  prescription drug event data to CMS. The prescription drug event data  record contains PHI, such as date of birth, the pharmacy that filled the  prescription, and the drug dispensed, that enables CMS to make  payments to plans. Appendix II provides a summary of the permitted uses  and disclosures of PHI.
subsections: section_title: Prescription Drug Use Information Can Be Used for Purposes Other than Direct Clinical Care
paragraphs: Under certain circumstances, PHI, including prescription drug use  information, can be used for purposes not related to directly providing  clinical care to an individual. For example, CMS makes Medicare  beneficiaries’ prescription drug event data available for use in research  studies. Release of these elements outside of CMS must be in  accordance with its policies and data-sharing procedures. For example, in  order to obtain access to this information interested parties must send in  an application and submit a user agreement. Table 1 provides other  examples of using prescription drug use data for purposes other than  directly providing clinical care.
Depending on the nature of the use, the prescription drug use information  is used and transmitted in identifiable form or in de-identified format,  which involves the removal of PHI (e.g., name, date of birth, and Social  Security number) that can be used to identify an individual.
section_title: Federal Laws Establish Privacy and Security Protections of Individually Identifiable Health Information Including Prescription Drug Use Information Used for Purposes Other than Direct Clinical Care
paragraphs: Key privacy and security protections associated with individually  identifiable health information, including prescription drug information  used for purposes other than directly providing clinical care, are  established in two federal laws, HIPAA and the HITECH Act.
Recognizing that benefits and efficiencies could be gained by the use of  information technology in health care, as well as the importance of  protecting the privacy of health information, Congress passed HIPAA in  1996. Under HIPAA, the Secretary of HHS is authorized to promulgate  regulations that establish standards to protect the privacy of certain health  information and is also required to establish security standards that  require covered entities that maintain or transmit health information to  maintain reasonable and appropriate safeguards.
HIPAA’s Administrative Simplification Provisions provided for the  establishment of national privacy and security standards, as well as the  establishment of civil money and criminal penalties for HIPAA violations.  HHS promulgated regulations implementing the act’s provisions through  its issuance of the HIPAA rules–the Privacy Rule, the Security Rule, and  the Enforcement Rule. The rules cover PHI and require that covered  entities only use or disclose the information in a manner permitted by the  Privacy Rule, and take certain measures to ensure the confidentiality and  integrity of the information and to protect it against reasonably anticipated  unauthorized use or disclosure and threats or hazards to its security.
HIPAA provides authority to the Secretary to enforce these standards.  The Enforcement Rule provides rules governing HHS’s investigation of  compliance by covered entities, both through the investigation of  complaints and the conduct of compliance reviews, and also establishes  rules governing the process and grounds for establishing the amount of a  civil money penalty for a HIPAA violation. The Secretary has delegated  administration and enforcement of privacy and security standards to the  department’s Office for Civil Rights (OCR).
The HITECH Act, enacted as part of the American Recovery and  Reinvestment Act of 2009 (Recovery Act), is intended to promote the  adoption and meaningful use of health information technology to help  improve health care delivery and patient care. The act adopts  amendments designed to strengthen the privacy and security protections  of health information established by HIPAA and also adopts provisions  designed to strengthen and expand HIPAA’s enforcement provisions.
Table 2 below provides a brief overview of the HITECH Act’s key  provisions for strengthening HIPAA privacy and security protection  requirements.
Under the HITECH Act, the Secretary of HHS has significant  responsibilities for enhancing existing enforcement efforts, providing  public education related to HIPAA protections, and providing for periodic  audits to ensure HIPAA compliance.
In implementing the act’s requirements, OCR’s oversight and  enforcement efforts are to be documented and reported annually to  Congress. These annual reports provide information regarding complaints  of alleged HIPAA violations and the measures taken to resolve the  complaints. These reports and other related information are required by  the HITECH Act to be made publicly available on HHS’s website.
section_title: HHS Has a Framework for Protecting Medicare Beneficiaries’ Prescription Drug Use Information but Has Not Issued Required Guidance or Implemented Required Oversight Capabilities
paragraphs: In response to requirements set forth in HIPAA and the HITECH Act,  HHS, through OCR, has established a framework for protecting the  privacy and security of individually identifiable health information,  including Medicare beneficiaries’ prescription drug use information used  for purposes other than directly providing clinical care. This framework  includes (1) establishing regulatory requirements, (2) issuing guidance  and performing outreach efforts, and (3) conducting enforcement  activities to ensure compliance with the rules. However, OCR has not  issued required guidance to assist entities in de-identifying individually  identifiable health information due to—according to officials—competing  priorities for resources and internal and external reviews. Furthermore,  although it has recently initiated a pilot audit program, the office has not  implemented periodic compliance audits as required by the HITECH Act.  Until these requirements are fulfilled, OCR will have limited assurance  that covered entities and business associates are complying with HIPAA  regulations.
subsections: section_title: HHS Issued Regulations to Implement Key HIPAA and HITECH Act Requirements for Protecting PHI
paragraphs: The Secretary of HHS issued regulations, such as the HIPAA rules, that  implement HIPAA requirements and amendments required by the  HITECH Act to govern the privacy and security of individually identifiable  health information, known as PHI. These rules establish the required  protections and acceptable uses and disclosures of individually  identifiable health information, including Medicare beneficiaries’  prescription drug use information.
HIPAA provided for the Secretary of HHS to, among other things, (1)  issue privacy regulations governing the use and disclosure of PHI and (2)  adopt security regulations requiring covered entities to maintain  reasonable and appropriate technical, administrative, and physical  safeguards to protect the information.
In December 2000, to address the privacy regulation requirement, HHS  issued the Privacy Rule. The Privacy Rule regulates covered entities’  use and disclosure of PHI. Under the Privacy Rule, a covered entity may  not use or disclose an individual’s PHI without the individual’s written  authorization, except in certain circumstances expressly permitted by the  Privacy Rule. The Privacy Rule reflects basic privacy principles for  ensuring the protection of personal health information, as summarized in  table 3.
The Privacy Rule generally requires that a covered entity make  reasonable efforts to use, disclose, or request only the minimum  necessary PHI to accomplish the intended purpose. Further, the Privacy  Rule establishes methods for de-identifying PHI. Under the rule, once  identifiers are removed from a data set, it is no longer considered  individually identifiable health information and the HIPAA protections no  longer apply. De-identification provides a mechanism for reducing the  amount of PHI used and disclosed. The Privacy Rule establishes two  ways in which PHI can be de-identified. The Safe Harbor Method requires  the removal of 18 unique types of identifiers from a data set coupled with  no actual knowledge that the remaining data could be used to reidentify  an individual, either alone or in combination with other information. The  expert determination method requires a qualified statistician or other  appropriate expert, using generally accepted statistical and scientific  principles, to determine that the risk is very small that an individual could  be identified from the information when used alone or in combination with  other reasonably available information.
In February 2003, to implement HIPAA security requirements for  protecting PHI, HHS issued the HIPAA Security Rule. To ensure that  reasonable safeguards are in place to protect electronic PHI, including  Medicare beneficiaries’ health information, from unauthorized access or  disclosure, the Security Rule specifies a series of administrative,  technical, and physical safeguards for covered entities to implement to  ensure the confidentiality, integrity, and availability of electronic PHI.  Table 4 summarizes these security safeguards.
The Security Rule, which applies only to PHI in electronic form, states  that covered entities have the flexibility to use any security measures that  allow them to reasonably and appropriately implement specified  standards. Specifically, the rule states that in deciding what security  measures are appropriate, the covered entity must take into account  elements such as its size, complexity, technical infrastructure, cost of  security measures, and the probability and criticality of potential risks to  its PHI.
The HITECH Act set additional requirements for the Secretary of HHS  and expanded and strengthened certain privacy and security  requirements mandated under HIPAA and the HIPAA rules. Specifically,  to implement provisions of the HITECH Act, the Secretary was required to  (1) issue breach notification regulations to require covered entities and  business associates under HIPAA to provide notification to affected  individuals and the Secretary concerning the unauthorized use and  disclosure of unsecured PHI; (2) establish enforcement provisions for  imposing an increased tiered structure for civil money penalties for  violations of the Privacy and Security Rules; and (3) extend certain  Privacy and Security Rule requirements to business associates of  covered entities. Such required activities are intended to strengthen  protections for PHI, including Medicare beneficiaries’ prescription drug  use information.
To implement these provisions of the act, OCR issued two interim final  rules—the Breach Notification for Unsecured Protected Health  Information Rule, known as the “Breach Notification Rule,” and the  HITECH Act Enforcement Rule—and has developed a draft rule  intended to, among other things, extend the applicability of certain  requirements of the Privacy and Security Rules to business associates.  OCR issued the Breach Notification for Unsecured Protected Health  Information Rule in August 2009. This rule contains detailed requirements  for HIPAA-covered entities and business associates to notify affected  individuals and the Secretary following the discovery of a breach of  unsecured PHI. In addition, in October 2009, OCR issued the HITECH  Enforcement Rule, which amends the HIPAA rules to incorporate  HITECH Act provisions establishing categories of violations based on  increasing levels of culpability and correspondingly increased tier ranges  of civil money penalty amounts.
In addition, in July 2010, OCR issued a notice of proposed rulemaking  to modify the HIPAA Privacy, Security, and Enforcement Rules to  implement other provisions of the HITECH Act. According to the OCR  website, the proposed rule is intended to, among other things, make  modifications to extend the applicability of certain Privacy and Security  Rule requirements to the business associates of covered entities,  strengthen limitations on the use or disclosure of PHI for marketing and  fundraising and prohibit the sale of PHI, and expand individuals’ rights to  access their information and obtain restrictions on certain disclosures of  protected health information to health plans. According to OCR officials,  the proposed rule is currently under review by the Office of Management  and Budget (OMB), and OCR officials have not determined an estimated  time frame for its issuance.
section_title: OCR Provides Guidance and Outreach on the Use of PHI, but Has Not Issued Required De-identification Guidance
paragraphs: The HITECH Act also requires HHS to educate members of the public  about how their PHI, which may include Medicare beneficiaries’  prescription drug use information, may be used. In addition, the HITECH  Act requires HHS to provide guidance for covered entities on  implementing HIPAA requirements for de-identifying data—that is, taking  steps to ensure the data cannot be linked to a specific individual.  Specifically, the act requires HHS to provide information to educate  individuals about the potential uses of PHI, the effects of such uses, and  the rights of individuals with respect to such uses. In addition—to clarify  the de-identification methods established in the HIPAA Privacy Rule—the  HITECH Act required OCR to produce guidance by February 2010 on  how best to implement the HIPAA Privacy Rule requirements for the de- identification of protected health information.
OCR has undertaken an array of efforts since the rules were issued, as  well as to implement the HITECH Act’s requirements to promote  awareness of the general uses of PHI and the privacy and security  protections afforded to the identifiable information. For example, the office  has made various types of information resources publicly available.  Through its website, the office provides a central hub of resources related  to HIPAA regulations, ranging from guidance to consumers on their rights  and protections under the HIPAA rules to compliance guidance to  covered entities. More specifically, the office has developed resources  to guide covered entities and business associates in implementing the  provisions of the Privacy and Security Rules, which include, among other  things, examples of business associate contract provisions for sharing  PHI, answers to commonly asked questions, summaries of the HIPAA  rules, and information on regional privacy officers designated to offer  guidance and education assistance to entities and individuals on rights  and responsibilities related to the Privacy and Security Rules.
Table 5 below provides a brief overview of OCR’s guidance and  education outreach activities in regard to their target audience, purpose,  and guidance materials.
In another effort to promote awareness, OCR–—in conjunction with the  Office of the National Coordinator for Health Information Technology— established a Privacy and Security Toolkit to provide guidance on privacy  and security practices for covered entities that electronically exchange  health information in a network environment. The toolkit was developed to  implement the Nationwide Privacy and Security Framework for Electronic  Exchange of Individually Identifiable Health Information, also known as  the Privacy and Security Framework, and includes tools to facilitate the  implementation of these practices to protect PHI. Guidance included with  the toolkit includes, among other things, security guidelines to assist small  health care practices as they become more reliant on health information  technology and facts and template examples for developing notices for  informing consumers about a company’s privacy and security policies in a  web-based environment.
Although OCR has initiated these efforts to fulfill its responsibilities to  promote awareness of allowable uses and provide guidance for  complying with required protections under the HITECH Act, it has yet to  publish HITECH Act guidance on implementing HIPAA de-identification  methods, which was to be issued by February 2010. OCR officials  stated that they have developed a draft of the de-identification guidance,  but have not set an estimated issuance date. According to the officials,  the draft guidance was developed based on the office’s solicitation of best  practices and guidelines from multiple venues and forums, including a  workshop panel discussion with industry experts in March 2010 that  included discussions on best practices and risks associated with de- identifying PHI. The officials stated that guidance will explain and answer  questions about de-identification methods as well as clarify guidelines for  conducting the expert determination method of de-identification to reduce  entities’ reliance on the Safe Harbor method.
The issuance of such implementation guidance could provide covered  entities—including those that rely on de-identified prescription drug use  information for purposes other than directly providing clinical care—with  guidelines and leading practices for properly de-identifying PHI in  accordance with Privacy Rule requirements. According to OCR officials,  competing priorities for resources and internal reviews have delayed the  issuance of the guidance. Officials stated that the draft is currently under  government wide review. Although officials stated that the guidance will  be issued upon completion of the review, no estimated time frame has  been set. Until this guidance is issued, increased risk exists that covered  entities are not properly implementing the standards set by the HIPAA  Privacy Rule and that identifiers are not properly removed from PHI.
section_title: OCR Conducts Enforcement and Oversight Activities but Has Yet to Implement a Sustained Audit Capability
paragraphs: Federal laws authorize HHS to take steps to ensure that covered entities  comply with HIPAA privacy and security requirements targeted toward  protecting patient data, including Medicare beneficiaries’ prescription drug  use information. Specifically, HHS has authority to enforce compliance  with the Privacy and Security Rules in response to, among other things,  (1) complaints reporting potential privacy and security violations and (2)  data breach notifications submitted by covered entities. Furthermore,  the HITECH Act increased HHS’s oversight responsibilities by requiring  the department to perform periodic audits to ensure covered entities and  business associates are complying with the Privacy and Security Rules  and breach notification standards.
OCR has developed and implemented an enforcement process that is  focused on conducting investigations in response to actions that  potentially violate the Privacy and Security Rules. According to OCR  officials, the office opens investigations in response to submitted  complaints and data breach notifications, as well as conducts compliance  reviews based on other reports of potential violations of which the  department becomes aware. If necessary, it then requires covered  entities to make changes to their privacy and security practices.
OCR receives thousands of complaints and breach notifications each  year. Officials stated that these complaints and notifications are reviewed to  determine if they are eligible for enforcement and require an OCR  investigation. According to information provided by OCR, from 2006 to  2010 the office has received on average about 8,000 Privacy and  Security Rule complaints each year. OCR officials reported that as of  February 2012, the office conducted investigations of approximately 24,000  complaints alleging compliance violations of the Privacy or Security Rule,  resulting in corrective actions by covered entities in 66 percent of the  cases. Corrective actions have included training or sanctioning employees,  revising policies and procedures, and mitigating any alleged harm.  According to OCR’s annual report to Congress on HIPAA Privacy and  Security Rule compliance, in instances where an investigation resulted in  a determination that a violation of the Privacy or Security Rule occurred,  the office first attempted to resolve the case informally by obtaining  voluntary compliance through corrective action. Compliance issues  investigated most often include impermissible uses and disclosures of PHI  and lack of safeguards for or patient access to PHI.
As of May 2012, OCR investigations have resulted in the issuance of a  resolution agreement in eight cases. According to OCR officials, a  resolution agreement is a formal agreement between OCR and the  investigated entity and is used to settle investigations with more serious  outcomes. A resolution agreement is a contract signed by HHS and a  covered entity in which the covered entity agrees to perform corrective  actions (e.g., staff training), submit progress reports to HHS (generally for  a period of 3 years), and—in some cases—pay a monetary fine. The  eight resolution agreements entered into with the investigated entities all  included a payment of a resolution amount, and the development or  revision of policies and procedures. In six of these cases further  submission of compliance reports or compliance monitoring was required  for 2 to 3 years. For example, in response to complaints that several  patients’ electronic PHI was viewed without permission by university  health system employees, OCR initiated an investigation which revealed  that unauthorized employees repeatedly looked at the electronic PHI for  numerous patients. The university health system agreed to settle potential  violations of the Privacy and Security Rules by committing to a corrective  action plan and paying approximately $865,000.
When a covered entity does not cooperate with an OCR investigation or  take action to resolve a violation, the office also has the authority to  impose a civil money penalty. OCR can levy civil money penalties for  failure to comply with the requirements of the Privacy Rule, Security Rule,  and Breach Notification Rule. For each violation, the maximum penalty  amount in four separate categories is $50,000. For multiple violations of  an identical provision in a calendar year, the maximum penalty in each  category is $1.5 million. As of May 2012, OCR had issued one civil  money penalty for noncompliance in the amount of $4.3 million. Since  February 2010, pursuant to the HITECH Act, OCR has received and used  the money from settlement amounts and civil money penalties for  enforcement of the HIPAA rules.
In June 2011, OCR initiated efforts to conduct pilot audits of 150 covered  entities by the end of December 2012. The office contracted for a private  firm to identify the population of covered entities from which to select  audit candidates. Additionally, the office contracted with a private audit  firm to develop the initial audit procedures for covered entities. These  procedures—which OCR documentation asserts are to be in accordance  with generally accepted government auditing standards—are composed  of the requirements from the Privacy, Security and Breach Notification  Rules, which include protections afforded to prescription drug use  information and uses of it for purposes other than directly providing  clinical care. In January 2012, OCR officials stated that the target for  audits to complete was revised to 115.
According to OCR documentation, during the pilot each audit is  conducted based on the following steps:  1.  An audit is initiated with the selected covered entity being informed by  OCR of its selection and asked to provide documentation of its  privacy, security, and breach notification compliance efforts to the  contracted auditors.  2.  Contracted auditors use the audit procedures developed to assess the  compliance activities of the covered entity. According to officials and  documentation provided, these procedures correspond to the  requirements of the Privacy, Security, and Breach Notification Rules.  In this pilot phase, every audit will include a documentation review  and site visit.  3.  Contracted auditors will provide the audited covered entity the draft  findings within 30 days after conclusion of the field work.  4.  Audited entities will have 10 days to provide the audit contractor with  comments and outline corrective actions planned or taken.  5.  Contracted auditors will develop a final audit report to submit to OCR  within 30 days of receipt of the comments. The final report will  describe how the audit was conducted, what the findings were, and  what actions the covered entity is taking in response to those findings  as well as describe any best practices of the entity.
According to OCR officials, an initial set of 20 pilot audits was completed  by March 2012. Officials stated that these initial audits resulted in the  identification of both privacy and security issues at covered entities, such  as potential impermissible uses and disclosures and not appropriately  conducting reviews of audit logs and other reports monitoring activity on  information systems. OCR officials stated that the remaining 95 pilot  audits, 25 of which were initiated in April 2012, will be completed by the  end of December 2012.
However, OCR has yet to establish plans for (1) continuing the audit  program once the audit pilot finishes in December 2012 and (2) auditing  business associates for privacy and security compliance. According to  OCR officials, the dedicated Recovery Act funding for the office’s audit  effort will expire at the end of December 2012 and officials stated that  they have not yet finalized a decision on the future of the program,  including the manner in which an audit process will need to be designed  to address compliance by business associates. OCR officials stated that  the office plans to award a contract in 2012 for a review of the pilot  program, including a sample of audits completed during the pilot. OCR  officials anticipate that this review will help determine how the office can  fully implement an audit function.
Implementing a sustained audit program could allow OCR to help covered  entities and business associates identify and mitigate risks and  vulnerabilities that may not be identified through OCR’s current reactive  processes. Furthermore, inclusion of business associates in such a  program is important because, according to OCR data, more than 20  percent of data breaches affecting over 500 individuals that were reported  to OCR involved business associates. Without a plan for deploying a  sustained audit capability on an ongoing basis, OCR will lack the ability to  ensure that covered entities and business associates are complying with  HIPAA regulations, including properly de-identifying PHI when data on  prescription drug use are used for purposes other than directly providing  clinical care.
section_title: Conclusions
paragraphs: Through its issuance of regulations, outreach, and enforcement activities,  HHS has established a framework for protecting the privacy and security  of Medicare beneficiaries’ prescription drug use information when used  for purposes other than directly providing clinical care. It has also  promoted public awareness on the uses and disclosures of PHI through  its education and outreach activities. Further, OCR has established and  implemented a process to enforce provisions of the HIPAA Privacy and  Security Rules through investigations. However, it has not issued required  implementation guidance to assist entities in de-identifying PHI. By not  issuing the guidance, increased risk exists that covered entities are not  properly implementing the standards set by the HIPAA Privacy Rule and  that PHI is not properly stripped of all identifiers that would identify an  individual. In addition, OCR has not fully established a capability to  proactively monitor covered entities’ compliance through the use of  periodic audits as required by the HITECH Act. Specifically, OCR has yet  to establish plans for a sustained audit capability upon completion of its  pilot program at the end calendar year 2012 and has yet to determine  how to include auditing business associates. Without a plan for deploying  a sustained audit capability on an ongoing basis, OCR will have limited  assurance that covered entities and business associates are complying  with HIPAA regulations, including whether Medicare beneficiaries’  prescription drug use information, when used for purposes other than  directly providing clinical care, is being appropriately safeguarded from  compromise.
section_title: Recommendations for Executive Action
paragraphs: To improve the department’s guidance and oversight efforts for ensuring  the privacy and security of protected health information, including  Medicare beneficiaries’ prescription drug use information, we recommend  that the Secretary of HHS direct the Director of the Office for Civil Rights  to take the following two actions:  Issue guidance on properly implementing the HIPAA Privacy Rule  requirements for the de-identification of protected health information.    Establish plans for conducting periodic audits to ensure covered  entities and business associates are complying with the HIPAA  Privacy and Security Rules and breach notification standards.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of the report, the HHS Assistant Secretary  for Legislation agreed with our two recommendations, but provided  qualifying comments for both. HHS’s comments are reprinted in   appendix III.
Regarding our recommendation that OCR issue guidance on properly  implementing the HIPAA Privacy Rule requirements for the de- identification of protected health information, the Assistant Secretary  stated that while the department agrees that issuing the guidance will be  helpful to covered entities, the department does not agree that without the  guidance, covered entities will have limited assurance that they are  complying with the HIPAA Privacy Rule de-identification standards. The  Assistant Secretary noted that covered entities have been operating  under these existing de-identification standards for almost 10 years and  that OCR has not found that the standards have been the subject of  significant or frequent compliance issues by covered entities. The  Assistant Secretary noted that OCR’s purpose in issuing the de- identification guidance was to provide covered entities with the current  options and approaches available for de-identifying health information.
We agree that the existing agency information on the de-identification  standards provide a level of assurance that covered entities have the  parameters and requirements needed to properly remove identifiers from  PHI and have clarified this in our report. However, the HITECH Act  requires HHS to issue de-identification implementation guidance that  addresses how covered entities should implement the de-identification  standards. OCR officials stated that the planned guidance will explain and  answer questions about de-identification methods as well as clarify  guidelines for conducting the expert determination method of de- identification to reduce entities’ reliance on the Safe Harbor method. Such  information could assist covered entities in determining how to properly  implement the de-identification methods. Until such implementation  guidance is issued, increased risk exists that covered entities are not  properly adhering to the standards set by the HIPAA Privacy Rule and  that PHI is not properly stripped of all identifiers that would identify an  individual.
Regarding our recommendation that OCR establish plans for conducting  periodic audits to ensure covered entities and business associates are  complying with the HIPAA Privacy and Security Rules and breach  notification standards, the Assistant Secretary stated the department did  not agree with our report’s conclusion that without such a plan, OCR will  lack the ability to ensure that covered entities and business associates  are complying with the HIPAA rules. Specifically, he stated that our  conclusion did not adequately take into account the considerable impact  of the thousands of complaint investigations, compliance reviews, and  other enforcement activities OCR conducts annually to ensure covered  entities are complying with the rules. He noted that although the audit  function is a critical compliance tool for identifying vulnerabilities, the  importance of the audit function should not be understood to diminish the  effectiveness of OCR’s other enforcement activities for bringing about and  enforcing compliance with the HIPAA rules.
As our report highlighted, OCR has developed and implemented an  enforcement process that is focused on responding to actions that  potentially violate the Privacy and Security Rules. OCR conducts this  reactive process through processing complaints and conducting  thousands of investigations each year. An audit program is an important  addition to OCR’s compliance program as it is a tool to identify  vulnerabilities before they cause breaches and other incidents. Without  the addition of a proactive process, such as an audit capability, OCR will  have limited assurance that covered entities are complying with HIPAA  regulations.
HHS also provided technical comments on the report draft, which we  addressed in the final report as appropriate.
We will send copies of this report to other interested congressional  committees and the Secretary of Health and Human Services. The report  will also be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions regarding this report, please  contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. Key contributors to this report are  listed in appendix IV.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: Our objective was to determine the extent to which the Department of  Health and Human Services (HHS) has established a framework to  ensure the privacy and security of Medicare beneficiaries’ protected  health information (PHI) when data on prescription drug use are used for  purposes other than their direct clinical care.
To address our objective, we identified HHS’s and its Office for Civil  Rights’ (OCR) responsibilities for protecting the privacy and security of  PHI by reviewing and analyzing the Health Insurance Portability and  Accountability Act (HIPAA), including the HIPAA Privacy and Security  Rules; the Health Information Technology for Economic and Clinical  Health (HITECH) Act; and applicable privacy best practices, such as the  Fair Information Practices.
To obtain information on OCR efforts in implementing HIPAA’s and the  HITECH Act’s requirements, we reviewed and analyzed documentation  related to the office’s public outreach and guidance efforts, enforcement  practices, and regulations for covered entity and business associate  compliance provided by the office and through the department’s website  and compared those documents to the office’s statutory requirements. To  obtain information on the office’s enforcement through complaint and  breach notice investigations, we interviewed officials, reviewed agency- provided and public information, and analyzed agency documentation.  We conducted interviews with OCR officials to discuss the department’s  approaches and future plans for addressing the protection and  enforcement requirements of the HIPAA Privacy and Security Rules that  applied to covered entities and business associates. We also analyzed  plans and documentation provided by OCR officials that described  enforcement and compliance activities for developing an audit  mechanism and compared them with requirements for the audit program  established in the HITECH Act.
To describe the uses of prescription drug use data for purposes other  than directly providing clinical care, we interviewed representatives from  several covered entities, business associates, and medical associations,  and reviewed the HIPAA Privacy Rule and academic publications.
We conducted this performance audit at the Department of Health and  Human Services in Washington, D.C., from August 2011 through June  2012, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Key Permissible Uses of Protected Health Information
subsections: section_title: Permissible use Treatment
paragraphs: Description  The provision, coordination, or management of health care  and related services among health care providers or by a  health care provider with a third party, consultation between  health care providers regarding a patient, or the referral of a  patient from one health care provider to another.
The various activities of health care providers to obtain  payment or be reimbursed for their services and of a health  plan to obtain premiums, to fulfill their coverage responsibilities  and provide benefits under the plan, and to obtain or provide  reimbursement for the provision of health care.  Certain administrative, financial, legal, and quality  improvement activities of a covered entity, as defined in the  Privacy Rule, that are necessary to run its business and to  support the core functions of treatment and payment.
Example  A hospital may use protected health information about  an individual to provide health care to the individual and  may consult with other health care providers about the  individual’s treatment.  A hospital may send a patient’s health care instructions  to a nursing home to which the patient is transferred.  A hospital emergency department may give a patient’s  payment information to an ambulance service provider  that transported the patient to the hospital in order for  the ambulance provider to bill for its service.
With certain exceptions, to make a communication about a  product or service that encourages recipients of the  communication to purchase or use the product or service.  Marketing includes an arrangement between a covered  entity and any other entity, whereby the covered entity  discloses PHI to the other entity in exchange for direct or  indirect remuneration, for the other entity or its affiliate to  make a communication about a product or service that  encourages recipients of the communication to purchase or  use the product or service. With limited exceptions, such as  for face to face communications, the Privacy Rule requires  an individual’s written authorization before a use or  disclosure of his or her PHI can be made for marketing.  Covered entities may disclose protected health information,  without authorization, to public health authorities who are  legally authorized to receive such reports for the purpose of  preventing or controlling disease, injury, or disability.
Conducting quality assessment and improvement  activities, and case management and care  coordination.  Business management and general administrative  activities, including those related to implementing and  complying with the Privacy Rule.  Needing an individual’s authorization:  A health plan sells a list of its members to a company  that sells blood glucose monitors, which intends to send  the plan’s members brochures on the benefits of  purchasing and using the monitors.  Not needing an individual’s authorization:  An insurance agent sells a health insurance policy in  person to a customer and proceeds to also market a  casualty and life insurance policy as well.
A systematic investigation, including research development,  testing, and evaluation, designed to develop or contribute to  generalizable knowledge. To use or disclose protected health  information without authorization by the research participant,  a covered entity must obtain either: (1) institutional review  board or privacy board waiver of authorization;   (2) representations for a preparatory to research activity;   (3) representations that the research is on the protected  health information of decedents; or (4) a data use agreement  with recipient where only a limited data sets is shared.
The social services department of a local government  might have legal authority to receive reports of child  abuse or neglect, in which case the Privacy Rule would  permit a covered entity to report such cases to that  authority without obtaining individual authorization.  Approval of a waiver of authorization by an Institutional  Review Board or Privacy Board for research, such as  for certain records research, when the Board has  determined that the use or disclosure of protected  health information involves no more than a minimal risk  to the privacy of individuals, and the research could not  practicably be conducted without the waiver and  without access to the protected health information.
section_title: Appendix III: Comments from the Department of Health and Human Services
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact above, John de Ferrari, Assistant Director; Nick  Marinos, Assistant Director; Sher`rie Bacon; Marisol Cruz; Wilfred  Holloway; Lee McCracken; Monica Perez-Nelson; Matthew Snyder;  Daniel Swartz; and Jeffrey Woodward made key contributions to this  report.