Health Information Technology: Efforts Continue but Comprehensive Privacy Approach Needed for National Strategy
Published: 2007-06-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In April 2004, President Bush called for the Department of Health and Human Services (HHS) to develop and implement a strategic plan to guide the nationwide implementation of health information technology (IT). The plan is to recommend methods to ensure the privacy of electronic health information. GAO was asked to summarize its January 2007 report. The report describes the steps HHS is taking to ensure privacy protection as part of its national health IT strategy and identifies challenges associated with protecting electronic health information exchanged within a nationwide health information network.
section_title: What GAO Found
paragraphs: HHS and its Office of the National Coordinator for Health IT have initiated actions to identify solutions for protecting personal health information through several contracts and with two health information advisory committees. For example, in late 2005, HHS awarded several health IT contracts that include requirements for addressing the privacy of personal health information exchanged within a nationwide health information exchange network. HHS's privacy and security solutions contractor is to assess the organization-level privacy- and security-related policies, practices, laws, and regulations that affect interoperable health information exchange. In June 2006, the National Committee on Vital and Health Statistics made recommendations to the Secretary of HHS on protecting the privacy of personal health information within a nationwide health information network and, in August 2006, the American Health Information Community convened a work group to address privacy and security policy issues for nationwide health information exchange. While its activities are intended to address aspects of key principles for protecting the privacy of health information, HHS is in the early stages of its efforts and has therefore not yet defined an overall approach for integrating its various privacy-related initiatives and addressing key privacy principles, nor has it defined milestones for integrating the results of these activities. GAO identified key challenges associated with protecting electronic personal health information in four areas.

section_title: Letter
paragraphs: We appreciate the opportunity to participate in today’s hearing on  privacy initiatives associated with the Department of Health and  Human Services’s (HHS) national health information technology  (IT) strategy. Key privacy principles for protecting personal  information have been in existence for years and provide a  foundation for privacy laws, practices, and policies. Those privacy  principles are reflected in the provisions of the Health Insurance  Portability and Accountability Act of 1996 (HIPAA) and its  implementing regulations, which define the circumstances under  which an individual’s protected health information may be used or  disclosed.
In April 2004, President Bush issued an executive order that called  for the development and implementation of a strategic plan to guide  the nationwide implementation of interoperable health IT in both  the public and private sectors. The plan is to address privacy and  security issues related to interoperable health IT and recommend  methods to ensure appropriate authorization, authentication, and  encryption of data for transmission over the Internet. The order also  established the position of the National Coordinator for Health  Information Technology within HHS as the government official  responsible for developing and implementing this strategic plan.
At your request, our testimony today summarizes our January 2007  report that (1) describes the steps HHS is taking to ensure privacy  protection as part of the national health IT strategy and (2) identifies  challenges associated with meeting requirements for protecting  personal health information within a nationwide health information  network. The testimony also describes relevant activities that HHS  has reported undertaking since our January report. In preparing for  this testimony, we relied primarily on our work supporting the  report, which contains a detailed overview of our scope and  methodology. The work on which this testimony is based was  performed in accordance with generally accepted government  auditing standards.
subsections: section_title: Background
paragraphs: According to the Institute of Medicine, the federal government has a  central role in shaping nearly all aspects of the health care industry  as a regulator, purchaser, health care provider, and sponsor of  research, education, and training. According to HHS, federal  agencies fund more than a third of the nation’s total health care  costs. Given the level of the federal government’s participation in  providing health care, it has been urged to take a leadership role in  driving change to improve the quality and effectiveness of medical  care in the United States, including expanded adoption of IT.
In April 2004, President Bush called for the widespread adoption of  interoperable electronic health records within 10 years and issued  an executive order that established the position of the National  Coordinator for Health Information Technology within HHS as the  government official responsible for the development and execution  of a strategic plan to guide the nationwide implementation of  interoperable health IT in both the public and private sectors. In  July 2004, HHS released The Decade of Health Information  Technology: Delivering Consumer-centric and Information-rich  Health Care—Framework for Strategic Action. This framework  described goals for achieving nationwide interoperability of health  IT and actions to be taken by both the public and private sectors in  implementing a strategy. HHS’s Office of the National Coordinator  for Health IT updated the framework’s goals in June 2006 and  included an objective for protecting consumer privacy. It identified  two specific strategies for meeting this objective—(1) support the  development and implementation of appropriate privacy and  security policies, practices, and standards for electronic health  information exchange and (2) develop and support policies to  protect against discrimination based on personal health information  such as denial of medical insurance or employment.
In July 2004, we testified on the benefits that effective  implementation of IT can bring to the health care industry and the  need for HHS to provide continued leadership, clear direction, and  mechanisms to monitor progress in order to bring about measurable  improvements. Since then, we have reported or testified on several  occasions on HHS’s efforts to define its national strategy for health  IT. We have recommended that HHS develop the detailed plans and  milestones needed to ensure that its goals are met and HHS agreed  with our recommendation and has taken some steps to define more  detailed plans. In our report and testimonies, we have described a  number of actions that HHS, through the Office of the National  Coordinator for Health IT, has taken toward accelerating the use of  IT to transform the health care industry, including the development  of its framework for strategic action. We have also described the  Office of the National Coordinator’s continuing efforts to work with  other federal agencies to revise and refine the goals and strategies  identified in its initial framework. The current draft framework— The Office of the National Coordinator: Goals, Objectives, and  Strategies—identifies objectives for accomplishing each of four  goals, along with 32 high-level strategies for meeting the objectives,  including the two strategies for protecting consumer privacy.
subsections: section_title: Health Insurance Portability and Accountability Act of 1996
paragraphs: Federal health care reform initiatives of the early- to mid-1990s were  inspired in part by public concern about the privacy of personal  medical information as the use of health IT increased. Congress,  recognizing that benefits and efficiencies could be gained by the use  of information technology in health care, also recognized the need  for comprehensive federal medical privacy protections and  consequently passed HIPAA. This law provided for the Secretary of  HHS to establish the first broadly applicable federal privacy and  security measures designed to protect individual health care  information.
HIPAA required the Secretary of HHS to promulgate regulatory  standards to protect certain personal health information held by  covered entities, which are certain health plans, health care  providers, and health care clearinghouses. It also required the  Secretary of HHS to adopt security standards for covered entities  that maintain or transmit health information to ensure that such  information is reasonably and appropriately safeguarded. The law  requires that covered entities take certain measures to ensure the  confidentiality and integrity of the information and to protect it  against reasonably anticipated unauthorized use or disclosure and  threats or hazards to its security.
HIPAA provides authority to the Secretary to enforce these  standards. The Secretary has delegated administration and  enforcement of privacy standards to the department’s Office for  Civil Rights and enforcement of the security standards to the  department’s Centers for Medicare and Medicaid Services.
Most states have statutes that in varying degrees protect the privacy  of personal health information. HIPAA recognizes this and  specifically provides that its implementing regulations do not  preempt contrary provisions of state law if the state laws impose  more stringent requirements, standards, or specifications than the  federal privacy rule. In this way, the law and its implementing rules  establish a baseline of mandatory minimum privacy protections and  define basic principles for protecting personal health information.
The Secretary of HHS first issued HIPAA’s Privacy Rule in  December 2000, following public notice and comment, but later  modified the rule in August 2002. Subsequent to the issuance of the  Privacy Rule, the Secretary issued the Security Rule in February  2003 to safeguard electronic protected health information and help  ensure that covered entities have proper security controls in place  to provide assurance that the information is protected from  unwarranted or unintentional disclosure.
The Privacy Rule reflects basic privacy principles for ensuring the  protection of personal health information. Table 1 summarizes these  principles.
section_title: HHS Has Initiated Actions to Identify Solutions for Protecting Personal Health Information but Has Not Defined an Overall Approach for Addressing Privacy
paragraphs: HHS and its Office of the National Coordinator for Health IT have  initiated actions to identify solutions for protecting health  information. Specifically, HHS awarded several health IT contracts  that include requirements for developing solutions that comply with  federal privacy and security requirements, consulted with the  National Committee on Vital and Health Statistics (NCVHS) to  develop recommendations regarding privacy and confidentiality in  the Nationwide Health Information Network, and formed the  American Health Information Community (AHIC) Confidentiality,  Privacy, and Security Workgroup to frame privacy and security  policy issues and identify viable options or processes to address  these issues. The Office of the National Coordinator for Health IT  intends to use the results of these activities to identify technology  and policy solutions for protecting personal health information as  part of its continuing efforts to complete a national strategy to guide  the nationwide implementation of health IT. However, HHS is in the  early stages of identifying solutions for protecting personal health  information and has not yet defined an overall approach for  integrating its various privacy-related initiatives and for addressing  key privacy principles.
subsections: section_title: HHS’s Contracts Are to Address Privacy and Security Policy and Standards for Nationwide Health Information Exchange
paragraphs: HHS awarded four major health IT contracts in 2005 intended to  advance the nationwide exchange of health information—Privacy  and Security Solutions for Interoperable Health Information  Exchange, Standards Harmonization Process for Health IT,  Nationwide Health Information Network Prototypes, and  Compliance Certification Process for Health IT. These contracts  include requirements for developing solutions that comply with  federal privacy requirements. The contract for privacy and security  solutions is intended to specifically address privacy and security  policies and practices that affect nationwide health information  exchange.
HHS’s contract for privacy and security solutions is intended to  provide a nationwide synthesis of information to inform privacy and  security policymaking at federal, state, and local levels and the  Nationwide Health Information Network prototype solutions for  supporting health information exchange across the nation. In  summer 2006, the privacy and security solutions contractor selected  34 states and territories as locations in which to perform  assessments of organization-level privacy- and security-related  policies and practices that affect interoperable electronic health  information exchange and their bases, including laws and  regulations. The contractor is supporting the states and territories  as they (1) assess variations in organization-level business policies  and state laws that affect health information exchange, (2) identify  and propose solutions while preserving the privacy and security  requirements of applicable federal and state laws, and (3) develop  detailed plans to implement solutions.
The privacy and security solutions contractor is to develop a  nationwide report that synthesizes and summarizes the variations  identified, the proposed solutions, and the steps that states and  territories are taking to implement their solutions. It is also to  address policies and practices followed in nine domains of interest:  (1) user and entity authentication, (2) authorization and access  controls, (3) patient and provider identification to match identities,  (4) information transmission security or exchange protocols  (encryption, etc.), (5) information protections to prevent improper  modification of records, (6) information audits that record and  monitor the activity of health information systems, (7)  administrative or physical security safeguards required to  implement a comprehensive security platform for health IT, (8) state  law restrictions about information types and classes and the  solutions by which electronic personal health information can be  viewed and exchanged, and (9) information use and disclosure  policies that arise as health care entities share clinical health  information electronically. These domains of interest address the  use and disclosure and security privacy principles.
section_title: The National Committee on Vital and Health Statistics Made Recommendations for Addressing Privacy and Security within a Nationwide Health Information Network
paragraphs: In June 2006, NCVHS, a key national health information advisory  committee, presented to the Secretary of HHS a report  recommending actions regarding privacy and confidentiality in the  Nationwide Health Information Network. The recommendations  cover topics that are, according to the committee, central to  challenges for protecting health information privacy in a national  health information exchange environment. The recommendations  address aspects of key privacy principles including (1) the role of  individuals in making decisions about the use of their personal  health information, (2) policies for controlling disclosures across a  nationwide health information network, (3) regulatory issues such  as jurisdiction and enforcement, (4) use of information by non- health care entities, and (5) establishing and maintaining the public  trust that is needed to ensure the success of a nationwide health  information network. The recommendations are being evaluated by  the AHIC work groups, the Certification Commission for Health IT,  the Health Information Technology Standards Panel, and other HHS  partners.
In October 2006, the committee recommended that HIPAA privacy  protections be extended beyond the current definition of covered  entities to include other entities that handle personal health  information. It also called on HHS to create policies and procedures  to accurately match patients with their health records and to require  functionality that allows patient or physician privacy preferences to  follow records regardless of location. The committee intends to  continue to update and refine its recommendations as the  architecture and requirements of the network advance.
section_title: The American Health Information Community’s Confidentiality, Privacy, and Security Workgroup Is to Develop Recommendations to Establish a Privacy Policy Framework
paragraphs: AHIC, a commission that provides input and recommendations to  HHS on nationwide health IT, formed the Confidentiality, Privacy,  and Security Workgroup in July 2006 to frame privacy and security  policy issues and to solicit broad public input to identify viable  options or processes to address these issues. The  recommendations to be developed by this work group are intended  to establish an initial policy framework and address issues including  methods of patient identification, methods of authentication,  mechanisms to ensure data integrity, methods for controlling access  to personal health information, policies for breaches of personal  health information confidentiality, guidelines and processes to  determine appropriate secondary uses of data, and a scope of work  for a long-term independent advisory body on privacy and security  policies.
The work group has defined two initial work areas—identity  proofing and user authentication—as initial steps necessary to  protect confidentiality and security. These two work areas address  the security principle. In January 2007, the work group presented  recommendations on performing patient identity proofing to AHIC.   The recommendations were approved by AHIC and submitted to  HHS. The work group intends to address other key privacy  principles, including, but not limited to maintaining data integrity  and control of access. It plans to address policies for breaches of  confidentiality and guidelines and processes for determining  appropriate secondary uses of health information, an aspect of the  use and disclosure privacy principle.
section_title: HHS’s Collective Initiatives Are Intended to Address Aspects of Key Privacy Principles, but an Overall Approach for Addressing Privacy Has Not Been Defined
paragraphs: HHS has taken steps intended to address aspects of key privacy  principles through its contracts and with advice and  recommendations from its two key health IT advisory committees.  For example, the privacy and security solutions contract is intended  to address all the key privacy principles in HIPAA. Additionally, the  uses and disclosures principle is to be further addressed through the  advisory committees’ recommendations and guidance. The security  principle is to be addressed through the definition of functional  requirements for a nationwide health information network, the  definition of security criteria for certifying electronic health record  products, the identification of information exchange standards, and  recommendations from the advisory committees regarding, among  other things, methods to establish and confirm a person’s identity.  The committees have also made recommendations for addressing  authorization for uses and disclosure of health information and  intend to develop guidelines for determining appropriate secondary  uses of data.
HHS has made some progress toward protecting personal health  information through its various privacy-related initiatives. For  example, during the past 2 years, HHS has defined initial criteria and  procedures for certifying electronic health records, resulting in the  certification of over 80 IT vendor products. In January 2007, HHS  contractors presented 4 initial prototypes of a Nationwide Health  Information Network (NHIN). However, the other contracts have  not yet produced final results. For example, the privacy and security  solutions contractor has not yet reported its nationwide assessment  of state and organizational policy variations. Additionally, HHS has  not accepted or agreed to implement the recommendations made in  June 2006 by the NCVHS, and the AHIC Privacy, Security, and  Confidentiality Workgroup is in the very early stages of efforts that  are intended to result in privacy policies for nationwide health  information exchange.
HHS is in the early phases of identifying solutions for safeguarding  personal health information exchanged through a nationwide health  information network and has not yet defined an approach for  integrating its various efforts or for fully addressing key privacy  principles. For example, milestones for integrating the results of its  various privacy-related initiatives and resolving differences and  inconsistencies have not been defined, and it has not been  determined which entity participating in HHS’s privacy-related  activities is responsible for integrating these various initiatives and  the extent to which their results will address key privacy principles.  Until HHS defines an integration approach and milestones for  completing these steps, its overall approach for ensuring the privacy  and protection of personal health information exchanged  throughout a nationwide network will remain unclear.
section_title: The Health Care Industry Faces Challenges in Protecting Electronic Health Information
paragraphs: The increased use of information technology to exchange electronic  health information introduces challenges to protecting individuals’  personal health information. In our report, we identify and  summarize key challenges described by health information  exchange organizations: understanding and resolving legal and  policy issues, particularly those resulting from varying state laws  and policies; ensuring appropriate disclosures of the minimum  amount of health information needed; ensuring individuals’ rights to  request access to and amendments of health information to ensure it  is correct; and implementing adequate security measures for  protecting health information. Table 2 summarizes these challenges.
Understanding and Resolving Legal and Policy Issues  Health information exchange organizations bring together multiple  and diverse health care providers, including physicians, pharmacies,  hospitals, and clinics that may be subject to varying legal and policy  requirements for protecting health information. As health  information exchange expands across state lines, organizations are  challenged with understanding and resolving data-sharing issues  introduced by varying state privacy laws. HHS recognized that  sharing health information among entities in states with varying  laws introduces challenges and intends to identify variations in state  laws that affect privacy and security practices through the privacy  and security solutions contract that it awarded in 2005.
Several organizations described issues associated with ensuring  appropriate disclosure, such as determining the minimum data  necessary that can be disclosed in order for requesters to  accomplish the intended purposes for the use of the health  information. For example, dieticians and health claims processors  do not need access to complete health records, whereas treating  physicians generally do. Organizations also described issues with  obtaining individuals’ authorization and consent for uses and  disclosures of personal health information and difficulties with  determining the best way to allow individuals to participate in and  consent to electronic health information exchange. In June 2006,  NCVHS recommended to the Secretary of HHS that the department  monitor the development of different approaches and continue an  open, transparent, and public process to evaluate whether a national  policy on this issue would be appropriate.
Ensuring Individuals’ Rights to Request Access and  Amendments to Health Information to Ensure It Is Correct  As the exchange of personal health information expands to include  multiple providers and as individuals’ health records include  increasing amounts of information from many sources, keeping  track of the origin of specific data and ensuring that incorrect  information is corrected and removed from future health  information exchange could become increasingly difficult.  Additionally, as health information is amended, HIPAA rules require  that covered entities make reasonable efforts to notify certain  providers and other persons that previously received the individuals’  information. The challenges associated with meeting this  requirement are expected to become more prevalent as the numbers  of organizations exchanging health information increases.
Implementing Adequate Security Measures for Protecting  Health Information  Adequate implementation of security measures is another challenge  that health information exchange providers must overcome to  ensure that health information is adequately protected as health  information exchange expands. For example, user authentication  will become more difficult when multiple organizations that employ  different techniques exchange information. The AHIC  Confidentiality, Privacy, and Security Workgroup recognized this  difficulty and identified user authentication as one of its initial work  areas for protecting confidentiality and security.
section_title: Implementation of GAO Recommendations Should Help Ensure that HHS’s Goal to Protect Personal Health Information is Met
paragraphs: To increase the likelihood that HHS will meet its strategic goal to  protect personal health information, we recommended in our  report that the Secretary of Health and Human Services define and  implement an overall approach for protecting health information as  part of the strategic plan called for by the President. This approach  should:   1.  Identify milestones and the entity responsible for integrating the  outcomes of its privacy-related initiatives, including the results  of its four health IT contracts and recommendations from the  NCVHS and AHIC advisory committees.  2.  Ensure that key privacy principles in HIPAA are fully addressed.   3.  Address key challenges associated with legal and policy issues,  disclosure of personal health information, individuals’ rights to  request access and amendments to health information, and  security measures for protecting health information within a  nationwide exchange of health information.
In commenting on a draft of our report, HHS disagreed with our  recommendation and referred to “the department’s comprehensive  and integrated approach for ensuring the privacy and security of  health information within nationwide health information exchange.”  However, in recent discussions with GAO, the National Coordinator  for Health IT agreed with the need for an overall approach to  protect health information and stated that the department was  initiating steps to address our recommendation.
Further, since our report was issued, HHS has reported that it has  undertaken additional activities to address privacy and security  concerns. For example:  ●  NCVHS’s subcommittee on privacy and confidentiality is drafting  additional recommendations for the Secretary of HHS regarding the  expansion of the HIPAA Privacy Rule coverage to entities that are  not currently covered. The recommendations are expected to be  presented to the NCVHS at its meeting later this month.  ●  The privacy and security solutions contractor is in the process of  analyzing and summarizing 34 states’ final assessments of  organization-level business practices and summaries of critical  observations and key issues. Its initial assessment identified  challenges that closely parallel those identified in our report. HHS  plans to finalize the findings and final reports from the contractor  after the contract ends at the end of this month.   ●  HHS awarded another contract, the State Alliance for e-Health,  which is intended to address state-level health IT issues, including  privacy and security challenges and solutions. In January 2007, the  alliance identified the protection of health information as a guiding  principle for its work. The alliance plans to identify privacy  practices and policies to help ensure the protection of personal  health information exchanged within a nationwide health  information network.
In summary, concerns about the protection of personal health  information exchanged electronically within a nationwide health  information network have increased as the use of health IT and the  exchange of electronic health information has also increased. HHS  and its Office of the National Coordinator for Health IT have  initiated activities that, collectively, are intended to protect health  information and address aspects of key privacy principles. While  progress continues to be made through the various initiatives, it  remains highly important that HHS define a comprehensive  approach and milestones for integrating its efforts, resolve  differences and inconsistencies among them, fully address key  privacy principles, ensure that recommendations from its advisory  committees are effectively implemented, and sequence the  implementation of key activities appropriately. If implemented  properly, HHS’s planned actions could help improve efforts to  address key privacy principles and the related challenges, and  ensure that the department meets its goal to safeguard personal  health information as part of its national strategy for health IT.
Mr. Chairman and members of the subcommittee, this concludes our  statement. We would be happy to respond to any questions that you  or members of the subcommittee may have at this time.
section_title: Contacts and Acknowledgments
paragraphs: If you have any questions on matters discussed in this testimony,  please contact Linda D. Koontz at (202) 512-6240 or Valerie C.  Melvin at (202) 512-6304 or by e-mail at koontzl@gao.gov or  melvinv@gao.gov. Other key contributors to this testimony include  Amanda C. Gill, Nancy E. Glover, M. Saad Khan, David F. Plocher,  and Teresa F. Tucker.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.