Electronic Health Information: HHS Needs to Strengthen Security and Privacy Guidance and Oversight
Published: 2016-08-26T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As a digital version of a patient's medical record or chart, an EHR can make pertinent health information more readily available and usable for providers and patients. However, recent data breaches highlight the need to ensure the security and privacy of these records. HHS has primary responsibility for setting standards for protecting electronic health information and for enforcing compliance with these standards.
GAO was asked to review the current health information cybersecurity infrastructure. The specific objectives were to (1) describe expected benefits of and cyber threats to electronic health information, (2) determine the extent to which HHS security and privacy guidance for EHRs are consistent with federal cybersecurity guidance, and (3) assess the extent to which HHS oversees these requirements. To address these objectives, GAO reviewed relevant reports, federal guidance, and HHS documentation and interviewed subject matter experts and agency officials.
section_title: What GAO Found
paragraphs: The use of electronic health information can allow providers to more efficiently share information and give patients easier access to their health information, among other benefits. Nonetheless, systems storing and transmitting health information in electronic form are vulnerable to cyber-based threats. The resulting breaches—involving over 113 million records in 2015—can have serious adverse impacts such as identity theft, fraud, and disruption of health care services, and their number has increased steadily in recent years, from 0 in 2009 to 56 in 2015 (see figure).
The Department of Health and Human Services (HHS) has established guidance for covered entities, such as health plans and care providers, for use in their efforts to comply with HIPAA requirements regarding the privacy and security of protected health information, but it does not address all elements called for by other federal cybersecurity guidance. Specifically, HHS's guidance does not address how covered entities should tailor their implementations of key security controls identified by the National Institute of Standards and Technology to their specific needs. Such controls include developing risk responses, among others. Further, covered entities and business associates have been challenged to comply with HHS requirements for risk assessment and management. Without more comprehensive guidance, covered entities may not be adequately protecting electronic health information from compromise.
HHS has established an oversight program for compliance with privacy and security regulations, but actions did not always fully verify that the regulations were implemented. Specifically, HHS's Office of Civil Rights investigates complaints of security or privacy violations, almost 18,000 of which were received in 2014. It also has established an audit program for covered entities' security and privacy programs. However, for some of its investigations it provided technical assistance that was not pertinent to identified problems, and in other cases it did not always follow up to ensure that agreed-upon corrective actions were taken once investigative cases were closed. Further, the office has not yet established benchmarks to assess the effectiveness of its audit program. These weaknesses result in less assurance that loss or misuse of health information is being adequately addressed.
section_title: What GAO Recommends
paragraphs: GAO is making five recommendations, including that HHS update its guidance for protecting electronic health information to address key security elements, improve technical assistance it provides to covered entities, follow up on corrective actions, and establish metrics for gauging the effectiveness of its audit program. HHS generally concurred with the recommendations and stated it would take actions to implement them.

section_title: Letter
paragraphs: Recent data breaches at hospitals, insurance companies, and other  entities in the health care industry have highlighted the importance of  ensuring the security and privacy of electronic health information,  including electronic health records (EHR). Two laws, The Health  Insurance Portability and Accountability Act of 1996 (HIPAA) and the  Health Information Technology for Economic and Clinical Health  (HITECH) Act, provide for the creation, enforcement, and monitoring of  information security and privacy standards for electronic health data.  Under these two laws, the Department of Health and Human Services  (HHS) has primary responsibility for setting standards for protecting  electronic health information and enforcing standards that protect  electronic health information.
To determine if the standards and guidance issued by HHS to protect  electronic health records are consistent with federal information security  guidance and if HHS oversight efforts are being effectively executed, you  requested that we conduct a study of the current health information  cybersecurity infrastructure. Our objectives were to (1) describe the  expected benefits and cyber threats to electronic health information; (2)  determine the extent to which HHS security and privacy guidance for  electronic health records reflect and align with federal guidance; and (3)  assess the extent to which HHS oversees compliance with HHS  information security and privacy requirements at covered entities.
To address our first objective, we analyzed prior GAO reports that  identified benefits of electronic health records. To identify major risks that  can affect systems that collect, maintain, and share electronic health  information, we analyzed prior GAO reports that identified security and  privacy threats to data and information systems. We also reviewed third- party analyses of the threat landscape affecting electronic health data and  systems and interviewed stakeholders and subject matter experts from  organizations that collect and analyze data on this subject. Further, we  analyzed information reported by HHS on health care data breaches  affecting 500 or more individuals and interviewed knowledgeable HHS  officials about the data. We determined that the data were sufficiently  reliable for our purposes by interviewing knowledgeable agency officials  and reviewing the data for obvious outliers.
For our second objective, we reviewed relevant information security and  privacy laws and National Institute of Standards and Technology (NIST)  standards and guidance to identify federal security and privacy control  recommendations. We also obtained key documents from a  representative sample of Security and Privacy Rules investigations  conducted by the HHS Office of Civil Rights (OCR) that were closed  between January 1, 2015, and December 10, 2015.
Regarding our third objective, we analyzed actions OCR took to close the  representative sample of investigations that we used for the second  objective. We compared OCR’s actions with its stated mission of  enforcing compliance with the Security and Privacy Rules and helping to  ensure the security and privacy of electronic health information. We also  interviewed knowledgeable OCR officials about their enforcement role  and activities.
We conducted this performance audit from June 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix I discusses our  objectives, scope, and methodology in greater detail.
subsections: section_title: Background
paragraphs: Digitizing health information has many potential benefits including  reducing costs and increasing medical accuracy. One key example of  digitized health information is an electronic health record (EHR). An EHR  is a digital version of a patient’s paper medical record or chart. EHRs  ideally make information available instantly and securely to authorized  users. They can contain the medical and treatment history of a patient,  diagnoses, medications, treatment plans, immunization dates, allergies,  radiology images, and laboratory and test results. These records can also  give a provider access to evidence-based tools for making decisions  about a patient’s care and can automate certain workflows.
System software for managing EHRs is typically purchased by providers  (such as physicians, hospitals, and health systems) from vendors that  develop the systems. When these systems are interoperable, information  can be exchanged—sent from one provider to another—and then  integrated into the receiving provider’s EHR system, allowing the provider  to use that health information to inform clinical care.
subsections: section_title: HIPAA Establishes Responsibilities for Developing and Enforcing Security and Privacy Standards
paragraphs: HIPAA required the Secretary of HHS to develop regulations protecting  the privacy and security of health information. To fulfill this requirement,  HHS published Standards for Privacy of Individually Identifiable Health  Information (the Privacy Rule) in December 2000 and Security Standards  for the Protection of Electronic Protected Health Information (the Security  Rule) in February 2003.
The Privacy Rule establishes national standards for safeguarding  protected health information (PHI). PHI is individually identifiable health  information that is transmitted or maintained in any form or medium. The  Privacy Rule states that PHI may be used or disclosed to other parties by  “covered entities” or their business associates only under specified  circumstances or conditions, and generally requires that a covered entity  or business associate make reasonable efforts to use, disclose, or  request only the minimum necessary PHI to accomplish the intended  purpose.
The Privacy Rule governs the use and disclosure of individuals’ health  information and also provides individuals with privacy rights with regard to  their health information. For example, the Privacy Rule provides the right  to request restrictions on uses and disclosures of PHI, the right to  adequate notification of privacy practices, the right of access to PHI, and  the right to request amendments to inaccurate or incomplete PHI. The  Privacy Rule also requires that covered entities and business associates  employ appropriate safeguards for protecting PHI.
The Security Rule establishes nationwide standards for safeguarding PHI  that is held or transferred electronically. It operationalizes the protections  contained in the Privacy Rule by specifying administrative, technical, and  physical security practices to secure individuals’ electronic protected  health information (ePHI). For example, the Security Rule requires  organizations to complete an enterprise-wide risk assessment and to  create a risk management plan to address identified risks.
In the Security Rule, HHS distinguishes between “required” and  “addressable” implementation controls. Required controls must be  implemented. In contrast, the requirement to implement “addressable  controls” is more open-ended. Organizations do not have to implement  these controls if they determine they are not “reasonable and appropriate”  and can document their reasons. However, they are required to  implement equivalent alternative measures to achieve a comparable level  of security assurance. Thus, while some action is required with regard to  addressable controls, a wide variety of interpretations and alternative  implementations is possible. Further, a variety of factors, such as  implementation cost and organizational size, can be considered when  making decisions on implementing addressable controls.
The HITECH Act was intended to promote the adoption and meaningful  use of health information technology. Subtitle D of the act includes  enhanced security and privacy protections associated with the electronic  transmission of health information, in part through several provisions that  strengthen the civil enforcement of the HIPAA rules. Further, the act  requires HHS to establish an audit function to ensure the implementation  of the Security and Privacy Rules by covered entities and business  associates. Also, pursuant to the HITECH Act, HHS has issued the  Interim Final Rule for Breach Notification for Unsecured Protected Health  Information, effective September 23, 2009.
Several components within HHS have responsibilities associated with  implementing HIPAA and the HITECH Act. For example, one of the  Centers for Medicare & Medicaid Services’ (CMS) responsibilities under  the HITECH Act is the administration of the Medicare and Medicaid  Electronic Health Records program, which provides incentives for eligible  entities that adopt and meaningfully use certified EHR technology.  Additionally, the Office of the National Coordinator is responsible for  setting standards for the implementation of systems that process  electronic health records.
OCR’s role is to implement and enforce the Privacy, Breach Notification  and Security Rules. The office is divided into eight separate regions and a  headquarters office in Washington, D.C. Each regional office has the  authority to investigate cases which can either be opened by the regional  office or assigned from the central intake unit located in headquarters. In  addition to investigating potential HIPAA violations, OCR is also  responsible for performing HIPAA compliance audits called for under the  HITECH Act.
section_title: Health Care Is a Sector of the U.S. Critical Infrastructure
paragraphs: U.S. critical infrastructure is the necessary services that support the  nation’s society and serve as the backbone of our economy, health, and  security. Critical infrastructure is comprised of systems and assets,  whether physical or virtual, so vital to the United States that the incapacity  or destruction of such systems and assets would have a debilitating  impact on the national public health or safety, nation’s security, or  national economic security. The critical infrastructure sectors were  defined in Presidential Policy Directive 21 and consist of 16 sectors, one  of which is health care and public health.
Public-private efforts to strengthen critical infrastructure help the public  sector enhance security and rapidly respond to and recover from hazard  events and assist the private sector in restoring business operations and  minimizing losses. Because most critical infrastructure assets are owned  and operated by the private sector, effective partnerships between private  and public sectors are key to protecting them. In addition to health care,  other sectors include financial services, communications, and information  technology.
The President issued Executive Order 13636, Improving Critical  Infrastructure Cybersecurity, in February 2013. The intent of the directive  was to strengthen the security and resilience of critical infrastructure  against evolving threats, while incorporating strong privacy and civil  liberties protections into cybersecurity initiatives. It called for an updated  national framework to reflect the increasing role of cybersecurity in  securing physical assets. The order directed NIST to work with  stakeholders to develop a voluntary framework, based on existing  standards and industry best practices, for reducing cyber risks to critical  infrastructure.
In response, in February 2014, NIST released the Framework for  Improving Critical Infrastructure Cybersecurity (Cybersecurity  Framework). Created through collaboration between government and the  private sector, the Cybersecurity Framework consists of standards,  guidelines, and practices to promote the protection of critical  infrastructure. The prioritized, flexible, repeatable, and cost-effective  approach of the framework is designed to help owners and operators of  critical infrastructure apply the principles and best practices of risk  management to improving the security and resilience of critical  infrastructure.
Executive Order 13636 directed sector-specific federal agencies to  establish, in coordination with the Department of Homeland Security, a  voluntary program to support the adoption of the NIST Cybersecurity  Framework by owners and operators of critical infrastructure and other  interested entities; create incentives to encourage owners and operators  of critical infrastructure to participate in the voluntary program; and, if  necessary, develop implementation guidance or supplemental materials  to address sector-specific risks and operating environments.
HHS was designated as the sector-specific agency for the health care  and public health sector. As a sector-specific agency, HHS is responsible  for providing institutional knowledge and specialized expertise as well as  leading, facilitating, or supporting the security and resilience programs  and associated activities for the sector. The health care and public health  sector protects the health of the population before, during, and after any  incident with actual or potential consequences. The sector consists of  direct health care, health plans and payers, pharmaceuticals,  laboratories, blood, medical materials, health information technology,  mortuary care, and public health.
section_title: Electronic Health Information Can Offer Substantial Benefits but Faces a Variety of Security and Privacy Threats
subsections: section_title: Electronic Health Information Provides Many Benefits to Patients and Providers
paragraphs: The use of health information technology, including EHR systems, has  the potential to allow health care providers and others to share health  care information electronically, which may lead to improved health care  quality and reduced costs. Electronic sharing of health information is  especially important because the health care system is highly  fragmented, with care and services provided in multiple settings, such as  physician offices and hospitals, that may not be coordinated. Because of  this fragmentation, providers may lack ready access to critical information  needed to coordinate the care of patients and to ensure that informed  decisions are made about the best treatment options. Lack of care  coordination can lead to inappropriate or duplicative tests and procedures  that can increase health risks to patients and poorer patient outcomes. As  we previously reported, estimates of this spending increase have ranged  from $148 billion to $226 billion per year.
EHR systems can overcome many of the limitations of manual health  records. Sharing clinical data using manual methods such as faxing paper  records can be time consuming and costly and may be unavailable at the  point of care. In addition, data shared via manual methods are generally  not formatted so that they can be easily accessed by other electronic  systems or stored in EHRs. Lacking the ability to access and store  manual data in their systems, providers may not be able to easily find the  information they need or electronically transmit it to another provider. In  contrast, effective electronic sharing of health information has the  potential to bring patient information directly from an EHR to the health  care professional providing the care, regardless of where the care or  services are delivered or when the information is needed.
Electronically exchanging information is also important in new  approaches to health care delivery, such as accountable care  organizations, because of the need for providers in different settings to  have ready access to information needed to manage and coordinate care.  Accountable care organizations, as defined by the Centers for Medicare &  Medicaid Services, are groups of doctors, hospitals, and other health care  providers who collaborate to give coordinated care to Medicare patients.  The goal of this coordinated care is to ensure that patients receive the  right care at the right time while avoiding unnecessary duplication of  services and preventing medical errors. Electronic health records have  the potential to improve the quality of care patients receive from such  organizations and to reduce health care costs.
Finally, according to the Office of the National Coordinator for Health  Information Technology, electronic exchange of health information is also  important to patients themselves. The interoperable electronic exchange  allows consumers to securely find and use vital health information,  enhancing care delivery, public health, and research, and empowering  them to make informed decisions regarding their health.
section_title: The Number of Incidents Resulting in the Loss of Electronic Health Information Is Increasing
paragraphs: While electronic health information can offer many potential benefits, it  can be vulnerable to security lapses that can jeopardize its confidentiality,  integrity, and availability. More individuals’ ePHI was compromised in  2015 than in any previous year following the establishment of the  HITECH Act in 2009, according to data that health care providers  reported to HHS. Based on these data, over 113 million individual health  care records were compromised in 2015 due to hacking or other  incidents. As figures 1 and 2 show, both the total number of reported  breaches involving health care records as well as the number of individual  records compromised have increased significantly since 2013.
The following are examples of recent large data breaches involving health  care information.
In May 2015, the University of California, Los Angeles (UCLA) Health  network discovered that records in its possession had been  compromised in a cyberattack on its information technology (IT)  systems. According to the UCLA Health website, the attackers  accessed parts of the UCLA Health network that contained personally  identifiable information (PII) such as names, addresses, dates of birth,  Social Security numbers, medical record numbers, Medicare or health  plan ID numbers, and some medical information. UCLA Health stated  that it had notified the Federal Bureau of Investigation (FBI) regarding  the cyberattack and pursued help from computer forensic experts to  investigate the incident. According to UCLA Health, it offered affected  individuals 12 months of identity theft recovery and restoration  services as well as a $1,000,000 insurance reimbursement policy and  additional health care identity protection. In addition, individuals  whose Social Security number or Medicare identification number was  stored on the parts of the network that had been compromised were  given 12 months of credit monitoring at no cost.
In January 2015, Anthem, Inc. learned of a large-scale cyberattack on  its IT systems. According to Anthem, the cyber-attackers obtained PII  for approximately 79 million individuals with Anthem accounts and  individuals who receive health care services in any of the areas that  Anthem serves, including names, dates of birth, Social Security  numbers, health care ID numbers, home addresses, e-mail  addresses, and employment information such as income data.  Anthem reported that, after discovering the attack, it contacted the  FBI, began working to close the security vulnerability, and contracted  with a cybersecurity firm to assist in the investigation and to  strengthen the security of its systems. Anthem also set up a website  with information specific to the incident and arranged to have identity  protection services provided to compromised individuals at no cost for  2 years.
Also in January 2015, Premera Blue Cross, which provides insurance  primarily to individuals in Alaska and Washington, discovered that  cyber attackers had gained unauthorized access to its IT systems.  Premera reported the initial attack had occurred in May 2014 and that  approximately 11 million records of patients and individuals who do  business with Premera were affected. According to Premera, cyber  attackers were able to access information such as names, addresses,  e-mail addresses, telephone numbers, dates of birth, Social Security  numbers, member identification numbers, medical claims information,  and bank account information. Premera reported that it was  cooperating with the FBI’s investigation into the attack and was  working with a cybersecurity contractor to remove the infection  created by the attack.
In July 2014, Community Health Systems, Inc. confirmed that its  computer network had been the target of a cyberattack. Community  Health Systems said that it engaged a cybersecurity contractor and  was working with federal law enforcement authorities. According to its  website, approximately 4.5 million individuals were affected, including  those who were referred for or received services within the previous 5  years. The data included patient names, addresses, birthdates,  telephone numbers, and Social Security numbers. Community Health  Systems said it notified affected patients and regulatory agencies and  offered no-cost identity theft protection services to affected  individuals.
These incidents reflect an increase in attacks against health information  that has been reported by organizations that monitor global information  security trends. For example, a study conducted by Mandiant reported  that health care IT breaches, which had previously been a minor portion  of their investigations, emerged in 2014 as a notable target for criminals.  Likewise, a study done by KPMG reported in 2015 that a survey of health  care executives indicated that health care organizations are frequently  targeted compared to other types of organizations and the magnitude of  the threat against health care information has grown exponentially.  Specifically, four-fifths of executives at health care providers and payers  told KPMG that their IT systems had been compromised by cyberattacks.  In its own study of historical health care industry data breaches, Verizon  reported that breaches of personally identifiable health information were  diverse and affected more industries than just health care. In 2014, the  FBI issued a warning to health care providers that the health care industry  was not as resilient to cyber intrusions as the financial and retail sectors,  increasing the potential for cyber intrusions.
section_title: Threats to Electronic Health Information Come from Multiple Sources and Can Have Significant Adverse Impacts
paragraphs: Threats to the security of systems containing health information can come  from a variety of sources. Intentional threats include both targeted and  untargeted attacks from a variety of sources, including criminal groups,  threat actors, foreign nations engaged in espionage, and health care  industry insiders. These threat sources vary in terms of the capabilities,  their willingness to act, and their motives, which can include monetary  gain or other motives.
According to subject matter experts, the increasing extent to which  electronic health information is subject to cyberattack reflects the  increased value of the compromised data on the black market. According  to these experts, criminals are aware that obtaining complete health  records are often more useful than isolated financial information, such as  credit information. Electronic health records often contain extensive  amounts of information about an individual. Cyber criminals seeking  access to health information for its resale value may use a variety of  readily available software tools to carry out attacks, such as intercepting  and capturing data as they are transmitted, exploiting known  vulnerabilities in commercially available software, and using e-mail  phishing techniques to gain unauthorized access to systems and  information.
In addition to the threat of cyberattack, health IT systems face significant  threats from insiders. While all of the breaches of over 1 million records in  2015 were attributed to outside attackers, a health care industry  representative told us that insiders are consistently identified as the  biggest threat. In addition to the threat of health care professionals and  staff directly accessing medical records for unauthorized purposes,  insiders may also fall victim to phishing attacks and other forms of social  engineering that could provide outside attackers with unauthorized  access to IT systems that they would not otherwise be able to obtain.
Finally, health information systems also face unintentional threats.  According to Verizon, 45 percent of breaches of personally identifiable  health information since 1994 have involved lost or stolen equipment that  contained unencrypted information. Another 20 percent of breaches were  attributable to errors such as mis-delivered documents, improper  disposal, and publishing errors.
Table 1 summarizes potential adverse impacts as well as the types of  groups or individuals that could pose threats to health information  systems.
section_title: HHS Security and Privacy Guidance Does Not Fully Address Important Controls Outlined in Federal Guidance
paragraphs: To encourage covered entities and business associates to implement  effective security and privacy protections, HHS established guidance for  compliance with the HIPAA requirements regarding the security and  privacy of protected health information. However, HHS investigations,  industry stakeholders, and HHS’s own reviews have shown that  organizations have struggled to select appropriate security and privacy  controls. For critical infrastructure sectors, such as health care, NIST has  published the Cybersecurity Framework to assist organizations in  selecting and implementing appropriate controls. However, the guidance  published by HHS does not address all of the elements in the NIST  guidance. HHS officials said they intended their guidance to be minimally  prescriptive to allow flexible implementation by a wide variety of covered  entities. However, until these entities address all the elements of the NIST  Cybersecurity Framework, their EHR systems and data are likely to  remain unnecessarily exposed to security threats.
subsections: section_title: HHS Developed Security and Privacy Risk Assessment Guidance for Covered Entities
paragraphs: HHS recognizes that performing a comprehensive risk assessment is  essential for organizations to understand their environment and to select  appropriate security and privacy controls. Under the Security Rule  promulgated by HHS, a key element for compliance with HIPAA  requirements is completing a security risk assessment. HHS guidance  states that conducting such an assessment serves as the foundation for  an organization’s security and privacy program as it represents a  comprehensive determination of the risks that are common to the  organization’s core functions, processes, segments, common  infrastructure, and information systems. A comprehensive risk  assessment reduces the risk of a HIPAA violation and increases  assurance that health information is protected appropriately.
According to OCR, an effective risk assessment includes analysis of the  potential risks and vulnerabilities to the confidentiality, availability and  integrity of all ePHI that an organization creates, receives, maintains, or  transmits. Security risk assessments are intended to be the basis for a  wide variety of risk-based decisions and activities by organizations  through all phases of designing, developing, implementing, and  maintaining information security controls. OCR identifies such  assessments as the first step in implementing safeguards and a  cornerstone of effective HIPAA compliance.
Because security risk assessments are central to the implementation of  effective security controls, OCR, in consultation with NIST, developed two  sets of guidance to help organizations of different sizes perform risk  assessments. According to OCR officials, the NIST HIPAA Security Rule  (HSR) Toolkit guidance was issued in 2010 and is meant to assist larger  covered entities and their business associates in conducting security risk  assessments. The stated purpose of the HSR Toolkit is to help covered  entities and their business associates better understand the requirements  of the HIPAA Security and Privacy Rules, implement those requirements,  and assess those implementations in their operational environment.
In response to feedback that the HSR Toolkit was difficult for smaller  entities to use, OCR issued additional guidance in coordination with the  Office of the National Coordinator for Health Information Technology  (ONC) in 2015. This guidance, referred to as the Security Risk  Assessment Tool, is designed to provide smaller covered entities and  business associates step-by-step guidance in conducting their  assessments.
Both guidance documents address the implementation specifications  identified in the HIPAA Security Rule and cover basic security practices,  security failures, risk management, and personnel issues. The tools are  organized as a series of questions addressing various security  categories. Basic security practice questions include defining and  managing access, backups, recoveries, and physical security. Risk  management questions address periodic reviews and evaluations. Lastly,  personnel issue questions address access to information as well as the  on-boarding and release of staff.
section_title: Covered Entities and Business Associates Have Been Challenged to Comply with the HIPAA Security and Privacy Rules
paragraphs: OCR investigations, industry stakeholders, and HHS’s own audits have  shown that covered entities and their business associates face  challenges in implementing the Security and Privacy Rules. Specifically,  HHS data from 2015 show that performing risk assessments and  developing risk management plans, which document how identified risks  are to be addressed, are among the most challenging aspects of the rules  for covered entities to implement. OCR investigations where corrective  actions were required showed that approximately 23.9 percent of  complaints and breach reports received by HHS result in investigations  that involve questions about how organizations have conducted risk  analyses and approximately 22.3 percent involve how organizations  developed risk management plans.
Further, stakeholders from the private sector have expressed concerns  that risk management programs under the HHS guidance are difficult  because requirements are not clearly defined. One stakeholder from a  private sector organization who works on HIPAA compliance and  assessment stated that it was difficult for organizations to know whether  they had adequately addressed all the requirements.
OCR identified incomplete risk assessments as an area of concern during  its pilot audit program. Under the HITECH Act, HHS was required to  conduct periodic audits to ascertain whether covered entities and  business associates are in compliance with the HIPAA Security and  Privacy Rules. In response, OCR developed and implemented a pilot  program that it used to conduct 115 audits of covered entities from 2012  to 2013. According to OCR officials, one trend identified during the pilot  program was a failure to complete risk assessments at many of the  covered entities that were audited. OCR officials noted that a failure to  complete a comprehensive risk assessment can put an organization at a  higher risk for failing to meet other HIPAA security and privacy  requirements, which could result in a breach of ePHI.
section_title: HHS Security Guidance Does Not Fully Align with the NIST Cybersecurity Framework
paragraphs: The Security Rule requires covered entities and their business associates  to perform risk analyses and create risk management plans. To provide  guidance on assessing risks to ePHI, HHS developed the Security Rule  Toolkit and Security Risk Assessment guidance. To supplement this  guidance and provide organizations assistance in developing risk  management plans that address identified risks, HHS published seven  documents called the HIPAA Security Information Series. Additionally,  HHS has published several pieces of threat-specific guidance to assist  covered entities in developing controls to address specific risks, such as  the risks to mobile devices.
Similarly, NIST has published the Cybersecurity Framework to provide  organizations in critical infrastructure sectors, including health care,  guidance on designing an effective information security program,  including both assessing risks and implementing controls to mitigate  them. NIST’s Cybersecurity Framework includes a core set of  cybersecurity activities common to all critical infrastructure sectors that  form a baseline of topics for critical infrastructure organizations to  consider as they tailor specific implementations of security controls to  meet their identified risks. The framework core is divided into five broad  security functions (Identify, Protect, Detect, Respond, and Recover),  which in turn are divided into 22 more specific categories and 98  subcategories. The 98 subcategories generally correspond to security  controls cited in NIST’s guidance on security and privacy controls for  federal information systems and organizations.
While adherence to the Cybersecurity Framework is voluntary, its core set  of security controls represents a consensus of topics to consider when  developing information security programs. It was developed by NIST with  extensive collaboration among private and public sector stakeholders. In  February 2016, OCR acknowledged the importance of the framework by  publishing the HIPAA Security Rule Crosswalk to NIST Cybersecurity  Framework, which maps the Security Rule’s administrative, physical,  and technical controls to relevant subcategories in the framework.  According to officials from HHS’s Office of the Coordinator for Health  Information Technology, this crosswalk was intended to show how  organizations’ existing HIPAA compliance efforts fit into the NIST  guidance.
However, while the crosswalk demonstrated that the major elements of  the Security Rule correspond to elements of the NIST Cybersecurity  Framework, HHS guidance does not address many of the specific  security control elements included in the Cybersecurity Framework. For  example, of the 98 framework subcategories, the HSR Toolkit fully  addresses only 19. Many of the specific controls detailed within the  framework’s 98 subcategories are not addressed in the either the HHS  security assessment guidance or in its other risk management  guidance. The HIPAA Security Information Series, which is intended to  provide additional guidance on remediating risks, outlines a high-level  approach to choosing and implementing controls and does not specifically  address the Cybersecurity Framework controls or how covered entities  and business associates should tailor them to meet their specific needs.
The Cybersecurity Framework subcategories that were not fully  addressed include a wide range of security controls. For example, the  guidance on risk assessments addresses controls from risk assessment  subcategories, such as the need to develop and perform risk  assessments, installing software updates, and receiving security alerts.  However, it does not address controls in other risk assessment  subcategories, such as penetration testing and developing risk  responses. Penetration testing ensures that controls are operating as  intended by testing to identify vulnerabilities that could be exploited. If  security controls are not operating as intended, covered entities may be  leaving their systems vulnerable to threats.
HHS officials stated that the HSR Toolkit and the Security Risk  Assessment guidance were designed specifically for the risk analysis  portion of the overall risk management process and thus were not  intended to assist organizations in the selection and tailoring of specific  security controls to meet their needs. However, gaps in the overall set of  guidance could lead to incomplete risk assessments and risk  management plans as well as inconsistent implementation of security  controls. Without addressing all major elements of the Cybersecurity  Framework, the guidance may not be helping guide these entities as  effectively as possible to comprehensively consider potential risks to the  security and privacy of electronic health information. As a result, systems  containing such information may remain unnecessarily vulnerable to  breaches and other security and privacy threats.
section_title: HHS Oversight Actions Did Not Always Ensure the Security and Privacy Rules Were Implemented
paragraphs: To enforce the Security and Privacy Rules, HIPAA grants HHS  investigatory powers and the ability to impose civil money penalties on  covered entities. The Secretary of HHS delegated these responsibilities to  OCR, which is charged with implementing and enforcing the HIPAA rules.  As part of its oversight of the implementation of the Security, Breach  Notification, and Privacy Rules by covered entities and business  associates, OCR has established an enforcement program to review the  high volume of complaints that are submitted each year. However, the  office does not always ensure that identified issues are corrected and  does not always issue appropriate guidance for cases resolved informally.  Further, while the office has developed an audit function as an additional  oversight function, as required under the HITECH Act, it is not yet fully  operational and its effectiveness is not yet known. The office also has not  demonstrated the effectiveness of its enforcement program over time or  fully communicated or coordinated its enforcement results with the  Centers for Medicare & Medicaid Services (CMS). Until HHS addresses  these issues, it is likely missing opportunities to ensure compliance and to  demonstrate the full effectiveness of its oversight program.
subsections: section_title: HHS Has Established a Program for Investigating Potential Violations of the HIPAA Security and Privacy Rules
paragraphs: Through OCR, HHS investigates potential violations of the HIPAA  Security, Breach Notification, and Privacy Rules. These investigations  may be initiated in several ways. For example, the office has established  a system for individuals to submit complaints about potential data  breaches or other potential violations of the HIPAA Security and Privacy  Rules, which it may investigate if warranted and based on resource  availability. HHS also provides covered entities a reporting system to  notify OCR of data breaches. The office assesses these cases to  determine whether to initiate investigations. In addition, OCR can initiate  its own investigations based on factors such as media reports, patterns of  repeat violations, or referrals from other government organizations,  among other instigating events.
OCR receives thousands of individual consumer complaints every year,  and the number has been growing. For example, OCR reported receiving  17,779 complaints regarding the potential violations of HIPAA rules in  2014; 12,974 in 2013; and 10,457 in 2012. To address the high volume of  cases that it receives, OCR has implemented a triage process where a  central intake unit reviews all complaints as they are submitted and  decides whether to (1) forward the complaint to a regional office for  further review and potential investigation, (2) provide “technical  assistance” in lieu of an investigation, or (3) decline to investigate.
Of the many complaints it receives, OCR opens investigations of  relatively few. Analysis of OCR case files shows that a variety of factors  limit the number of investigations. Reasons OCR may decline to  investigate a complaint include a lack of jurisdiction, a lack of consent  from an individual to disclose information to the entity being investigated,  allegations that would not constitute a violation of the Security and  Privacy Rules, or covered entities no longer being in business. In some  cases, instead of opening an investigation, the office may provide  technical assistance intended to clarify the responsibilities of covered  entities or how to implement specific aspects of the Security and Privacy  Rules.
According to OCR officials, if the office conducts a complaint  investigation, it has several options for reaching a resolution. It may  conclude that no violation has occurred or that corrective actions have  already been taken that address any identified deficiencies. Some  investigations may result in a resolution agreement, which may contain  items such as a binding corrective action plan, settlements, or  requirements for reporting to HHS on progress. Consistent with the  regulation, the office seeks primarily to resolve complaints through  informal means and technical assistance and resorts to fines only in  cases where the organization will not comply or in cases of willful neglect.  In the preamble to the Enforcement Rule, HHS stated that based on its  experience this method is effective and that the law does not mandate an  adversarial approach.
section_title: OCR Technical Assistance Did Not Always Address Identified Issues
paragraphs: While OCR does not investigate all complaints that are submitted, in  many cases it chooses to provide “technical assistance” intended to help  covered entities and business associates comply with Security, Breach  Notification, and Privacy Rule requirements. According to OCR officials,  and consistent with regulation, providing technical assistance is a way to  address cases that would otherwise be closed without an investigation.  For the 2015 period we reviewed, in most of the cases where technical  assistance was provided in lieu of a full investigation the guidance  documents provided were relevant to the issue. However, for 12 of the 94  cases we reviewed the technical assistance was not directly applicable to  the submitted complaint.
For example, in one case, a complaint was submitted about a covered  entity using easily guessed passwords to secure protected health  information before e-mailing it to individuals. HHS closed this complaint  by sending the covered entity a checklist for securing postal mail and  faxes rather than guidance for protecting e-mail. In several other cases  complaints were made about ePHI being inappropriately accessible on a  covered entity’s website. OCR provided guidance to the entities on  password protections for workstations, which was not relevant to the  identified website problem.
According to OCR officials, the reason that technical assistance does not  always address identified problems is that OCR has only limited technical  assistance guidance on hand, which may not always directly address  identified issues, and there is no review process to ensure that it is  consistent and relevant. OCR officials stated that resource limitations  have prevented them from developing a more comprehensive set of  technical guidance or establishing a review process. As a result, some  complaints are closed with organizations receiving limited guidance on  how to achieve compliance. The unaddressed weaknesses identified in  the complaints increase the risk of future HIPAA violations and may result  in entities continuing to employ weak security practices that could  jeopardize the security and privacy of the electronic health information in  their custody.
section_title: OCR Did Not Always Ensure That Corrective Actions Were Taken to Address Identified Issues
paragraphs: OCR’s letters closing out cases that it investigated did not always include  indications that covered entities had implemented or had committed to  implement corrective actions or other measures to better adhere to the  Security, Breach Notification, and Privacy Rules. Internal control  standards state that to ensure identified deficiencies are corrected in a  timely manner, oversight bodies should monitor the status of remediation  efforts until they are completed.
During the 2015 period we reviewed, most of the identified actions were  addressed before the cases were closed. However, in 13 of the 205  cases we reviewed where corrective actions were identified, such actions  were not addressed before closure.
In one case HHS concluded that a covered entity that had suffered a  breach had failed to fully address several key elements of the Security  and Privacy Rules. Specifically, the entity had not completed a risk  assessment or risk management plan, had not trained its staff  appropriately, did not have written policies and procedures for securing  protected health information, and did not use encryption. Although the  entity reported implementing improved encryption and data loss  prevention software, it had not provided evidence of instituting the  required training, establishing the required HIPAA compliance policies, or  conducting the required enterprise-wide risk assessment and risk  management plan. Nevertheless, HHS closed the investigation with these  significant issues outstanding. In its close-out letter, HHS encouraged the  entity to revisit its training policies and HIPAA compliance policies and  reminded it of its responsibilities to perform a risk assessment and create  a new risk management plan.
OCR requires monitoring of corrective actions for up to 3 years in cases  where it and an entity under its jurisdiction enter into a settlement  agreement. However in other cases, OCR does not generally follow up on  investigations where corrective actions are ongoing or where such actions  have not yet been fully implemented. HHS officials stated that the  covered entities and business associates understand that not addressing  identified issues could result in more serious enforcement actions if a  repeat issue were identified in future investigations. HHS cited a lack of  resources as the reason that it did not follow up with covered entities to  ensure that corrective actions were being implemented before closing  cases. OCR officials told us that they considered it a better use of  resources to open and pursue new investigations rather than tie up  resources waiting for covered entities to provide evidence that corrective  actions had been taken. According to these officials, follow-up is resource  intensive due to the need to constantly reassess an entity’s progress and  the quality of the actions it takes. Yet, without follow up, OCR cannot  determine whether corrective actions have actually been made to address  identified problems or whether covered entities have responded to  technical assistance with improvements to their electronic health  information protections. As a result, security and privacy weaknesses  may remain unaddressed.
section_title: OCR’s Audit Program Is Not Yet Operational, and Its Effectiveness Is Unknown
paragraphs: Under the HITECH Act, HHS is required to conduct periodic audits to  ensure that covered entities and business associates are in compliance  with the Security and Privacy Rules. In response, OCR developed and  implemented a pilot program that it used to conduct 115 audits of covered  entities and business partners from 2011 to 2012.
After the pilot program was completed, OCR analyzed the results and  used them to make adjustments in its audit protocol, which it finalized in  2016. For example, according to OCR officials, the revised protocol  makes the purpose of the audits clearer and provides more specific  information about the types of documents and time frames involved in an  audit. OCR has announced that it will begin an initial round of audits in  2016 by selecting and reviewing 224 covered entities and business  associates. The audits will be a combination of desk audits and on-site  reviews. While OCR officials acknowledged that this sample will not  represent a statistically projectable population, they stated that they  expect the results to highlight security and privacy issues facing covered  entities and business associates. For example, the final report from their  pilot project identified developing risk analyses and risk management  plans as a challenge for many entities.
OCR has not yet determined the proportion of audits that will be desk  audits versus site visits but expects the majority to be desk audits due to  resource constraints. Desk audits are designed to be less-intensive  document reviews that assess whether organizations have produced  artifacts such as policies, procedures, and assessments as required  under the Security, Breach Notification, and Privacy Rules. For site visits  a team of assessors visits an organization for 2 to 5 days and conducts  artifact reviews, interviews with organization personnel, and some  verification of implementation. According to OCR officials, these reviews  may include visual inspection of physical security controls but will not  include technical control testing, such as scanning servers for software  vulnerabilities.
An important piece of implementing effective internal controls, such as  audit programs, is establishing performance measurements for  management objectives such as these. However, because no audits  have yet been completed, it is not known whether OCR’s audit program  as currently planned will be effective in improving covered entities’  adherence to the Security, Breach Notification, and Privacy Rules. OCR  officials stated that the audit program’s results could be used as a  measure of the effectiveness of its overall enforcement program.  However, OCR has not yet established benchmarks or performance  measures to assess the effectiveness of the audit program when it  becomes operational. Without such benchmarks or measures it will be  difficult to determine whether the audit efforts as designed are effective.
section_title: OCR and CMS Do Not Share Results of all Privacy and Security Rules Investigations
paragraphs: While OCR and the Centers for Medicare & Medicaid Services (CMS)  coordinate through many joint activities, including sharing information  about breach reports, OCR and CMS do not share the results of their  investigations internally. Sharing information across organizational  boundaries can help organizations achieve their goals.
Specifically, OCR does not notify CMS of investigative cases it has  completed in which it has determined that risks assessments were not  conducted. A goal of the meaningful use incentive program that CMS  administers is to ensure that providers have implemented the  requirements that they have attested to, including the completion of risk  assessments. Specifically, to receive the incentives, eligible professionals  must attest that they have conducted a risk analysis as required by  HIPAA. While CMS conducts its own audits of program participants’  compliance with requirements for meaningful use incentives, OCR’s  investigations have at times also reviewed whether covered entities and  business associates have conducted risk analyses, and in some cases it  has determined that risk assessments were not completed. If those  entities were also participating in the meaningful use incentive program,  they should be ineligible for financial incentives. Nevertheless, OCR does  not notify CMS of these cases that might indicate ineligibility.
Sharing this information could allow CMS to better ensure that recipients  of financial incentives under the HITECH Act’s meaningful use program  have met the requirements for those incentives. In response, OCR stated  that CMS currently investigates entities based on its own jurisdiction  under meaningful use and other legal authorities and OCR and CMS  does not regularly coordinate on investigations. However, without OCR  and CMS sharing the results of investigations and audits, the potential is  increased for covered entities and business associates who have not  fulfilled the requirements to be inappropriately receiving incentive  payments.
section_title: Conclusions
paragraphs: While the increasing use of EHR systems has the potential to improve  health care quality, they can be vulnerable to security lapses that can  jeopardize the confidentiality, integrity, and availability of the information  they contain. Data breaches experienced by covered entities and their  business associates have resulted in tens of millions of individuals having  sensitive information compromised.
As required by HIPAA, HHS issued the Security, Breach Notification, and  Privacy Rules, as amended by the HITECH Act, and has implemented an  oversight program to enforce compliance by covered entities and  business associates. However, HHS’s guidance does not address how  covered entities should tailor their implementations of key security  controls identified by the National Institute of Standards and Technology  to their specific needs, and thus may not be as effective as it could be.
Although OCR continues to close thousands of cases per year, the  closure activities in a significant minority of cases do not provide  assurance that identified issues are addressed. When technical  assistance is used to close cases, it does not always address the  complaint directly or provide meaningful direction to organizations on how  to comply with the Security and Privacy Rules. Further, cases that are  closed with incomplete corrective actions and no follow-up do not provide  assurance that covered entities and their business associates are  completing the actions as agreed.
OCR has reported on steps it is taking to improve privacy and security in  the health care sector, including taking significant enforcement actions  and implementing its audit program. However, without establishing  measures for progress in improving security and privacy through its audit  program, it will be difficult to determine whether the program as designed  is effective. Additionally, OCR does not routinely coordinate with CMS to  help ensure that only eligible entities receive meaningful use incentive  payments under the HITECH Act’s EHR program.
section_title: Recommendations for Executive Action
paragraphs: To improve the effectiveness of HHS guidance and oversight of privacy  and security for health information we recommend that the Secretary of  Health and Human Services take the following actions: update security guidance for covered entities and business associates  to ensure that the guidance addresses implementation of controls  described in the NIST Cybersecurity Framework; update technical assistance that is provided to covered entities and  business associates to address technical security concerns;  revise the current enforcement program to include following up on the  implementation of corrective actions; establish performance measures for the OCR audit program; and establish and implement policies and procedures for sharing the  results of investigations and audits between OCR and CMS to help  ensure that covered entities and business associates are in  compliance with HIPAA and the HITECH Act.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft copy of this report to HHS for review and comment,  and in response the department provided written comments, which are  reproduced in appendix II. HHS stated that it concurred with three of the  five recommendations in the draft report and would take actions to  implement them. The department did not agree or disagree with the  remaining two recommendations but stated that it would consider taking  actions to implement them as well.
Regarding our third recommendation—that HHS revise the current  enforcement program to include following up on the implementation of  corrective actions—HHS stated that for settlement agreements, OCR  follows up with entities to ensure corrective actions have been taken. We  agree that for these cases, follow up does occur and have clarified this in  the final report. However, for cases that do not result in a settlement  agreement, ensuring that corrective actions have been taken would  provide OCR greater assurance that entities have implemented actions to  come into compliance with HIPAA requirements. Additionally, for those  cases that we identified where corrective actions had not been completed  before case closure, we intend to provide HHS with additional requested  information.
With regard to our fifth recommendation—that HHS improve information  sharing between OCR and CMS on organizations that may be in violation  of HIPAA requirements—HHS noted that OCR shares information with  CMS on breach reports. We note this in the report. However, our  recommendation focuses on OCR sharing information about the results of  its investigations with CMS, which is not currently done. Sharing this  information could allow CMS to better ensure that recipients of financial  incentives under the HITECH Act’s meaningful use program have met the  requirements for those incentives.
HHS also provided technical comments, which we incorporated as  appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Department of Health  and Human Services. In addition, the report will be available at no charge  on the GAO website at http://www.gao.gov.
If you or your staffs have questions about this report, please contact  Gregory C. Wilshusen at (202) 512-6244. He can also be reached by e- mail at wilshuseng@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) describe the expected benefits and cyber  threats to electronic health information; (2) determine the extent to which  the Department of Health and Human Services’ (HHS) security and  privacy guidance for electronic health records reflect and align with  federal guidance; and (3) assess the extent to which HHS oversees  compliance with HHS information security and privacy requirements at  covered entities.
To address our first objective, we analyzed prior GAO reports that  identified benefits of electronic health records and security and privacy  threats to data and information systems to identify major risks that can  affect systems that collect, maintain, and share electronic health  information. We also reviewed independent analyses of the threat  landscape affecting electronic health data and systems and interviewed  subject matter experts and stakeholders from organizations that collect  and analyze data on this subject. We identified these experts and  stakeholders through interviews with agency officials and other  stakeholders. They were considered subject matter experts and  stakeholders based on job titles, organizational affiliation, and  publications. Further, we analyzed information reported by HHS on health  care data breaches affecting over 500 individuals and interviewed  knowledgeable HHS officials about the data. We determined that the data  were sufficiently reliable for our purposes by interviewing knowledgeable  agency officials and reviewing the data for obvious outliers.
Regarding our second objective, we reviewed relevant information  security and privacy laws, including the Health Insurance Portability and  Accountability Act of 1996 and the Health Information Technology for  Economic and Clinical Health Act. Additionally, we reviewed the Security,  Breach Notification, and Privacy rules issued by HHS. We also reviewed  National Institute of Standards and Technology (NIST) standards and  guidance, including the Cybersecurity Framework and Special Publication  800-53, Security and Privacy Controls for Federal Information Systems, to  identify baseline security and privacy controls that are recommended for  consideration when conducting security risk assessments. We compared  these controls to those cited in HHS’s security risk assessment guidance  to identify potential gaps in the guidance. We also obtained key  documents from a representative sample of Security, Breach Notification,  and Privacy Rules investigations conducted by HHS’s Office of Civil  Rights (OCR) that were closed between January 1, 2015, and December  10, 2015. Specifically, we obtained and analyzed key documents, such as  notification letters and closure letters, associated with 205 cases that  OCR determined required a corrective action and 94 cases where OCR  provided technical assistance in lieu of investigation. Estimates based on  a probability sample are subject to sampling error. Because we followed a  probability procedure based on random selections, our sample is only one  of a large number of samples that we might have drawn. Since each  sample could have provided different estimates, we express our  confidence in the precision of our particular sample’s results as a 95  percent confidence interval (e.g., plus or minus 10 percentage points).  This is the interval that would contain the actual population value for 95  percent of the samples we could have drawn. We determined that these  data were sufficiently reliable for our purposes by examining the data for  outliers and interviewing knowledgeable officials about any discrepancies  we identified. We also interviewed knowledgeable HHS officials to  understand the purpose and structure of the HHS guidance.
To address our third objective, we analyzed actions OCR took to close  the representative sample of investigations that we used for the second  objective. We analyzed the circumstances under which OCR directed that  a corrective action be taken, provided technical assistance on complying  with the Security and Privacy Rules, or closed cases without taking any  action. We analyzed and compared OCR’s actions with its stated mission  of enforcing compliance with the Security and Privacy Rules and helping  to oversee standards for the security and privacy of protected health  information. We also interviewed knowledgeable OCR and CMS officials  about their enforcement role and oversight activities.
We conducted this performance audit from June 2015 to August 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, John de Ferrari (assistant  director), Thomas Johnson (Analyst in Charge), Carl Barden, Andrea  Harvey, Wilfred Holloway, Lee McCracken, Monica Perez-Nelson, Justin  Palk, and Paige Teigen made key contributions to this report.