Public Health Information Technology: HHS Has Made Little Progress toward Implementing Enhanced Situational Awareness Network Capabilities
Published: 2017-09-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: A public health event, such as a widespread disease outbreak or health problems resulting from a weather-related emergency, could have catastrophic consequences for the nation. These potential threats can be partially mitigated by having a national public health situational awareness capability—that is, a capability for public health officials to be able to access real-time information about emerging threats to enable them to make timely, responsive decisions to prepare for and respond to emergencies. PAHPRA required HHS to establish a near real-time electronic nationwide public health situational awareness capability through an interoperable network of systems.
PAHPRA also included a provision for GAO to evaluate HHS's progress in developing such a capability. This report addresses what progress HHS has made toward establishing the network. GAO analyzed documents describing HHS's plan for enhancing public health situational awareness and evaluated evidence of actions taken by HHS to establish the network required by PAHPRA. GAO also examined the department's IT planning and management processes and guidance, and interviewed HHS officials.
section_title: What GAO Found
paragraphs: The Pandemic and All-Hazards Preparedness Reauthorization Act of 2013 (PAHPRA) required the Secretary of Health and Human Services (HHS) to establish an electronic nationwide public health situational awareness network and to develop an implementation plan to guide its efforts. The law further required HHS to include in its plan specific activities for incorporating data into the network. HHS developed an implementation plan that identified several actions related to enhancing existing information-sharing capabilities needed to establish the network. However, the actions identified in the plan did not address all of the required activities, such as defining data elements and standards. Until the department addresses all required activities, it will lack an effective tool for ensuring that public health situational awareness network capabilities have been established in accordance with all of the requirements defined by the law.
In addition, HHS did not identify measurable steps for completing and tracking the status of the activities required by the law. PAHPRA required HHS to include in its plan the measurable steps to be taken to establish the network. Federal guidance also suggests that implementation plans identify timelines of tasks, cost and resource estimates, and performance metrics that can be used to track and monitor progress toward completing tasks and delivering expected outcomes. According to HHS officials who developed the implementation plan, the department established a committee of policy and planning experts from various federal agencies to define the measurable steps for completing the actions identified in the plan. However, HHS did not assign responsibilities for defining such steps to the committee, and the committee had not done so. Until the department defines measurable steps, it will not have the information and planning tools it needs to make progress toward establishing a network that provides information-sharing capabilities needed by public health entities to prepare for and respond to emergencies, as required by PAHPRA.
GAO identified other weaknesses in HHS's planning efforts that have contributed to the department's lack of progress toward establishing the network. Specifically, HHS did not follow guidance developed by its Chief Information Officer (CIO) for managing information technology (IT) resources. According to the guidance, officials who manage IT initiatives are to involve a governance organization led by HHS's CIO and designate a project team that includes a project manager and business owner. The team is to manage and oversee initiatives according to the guidance, including the development of a project management plan that identifies timelines and schedules, estimated project resources and costs, and performance metrics for tracking any progress made toward completing tasks and delivering expected outcomes. However, HHS did not designate such a team and did not involve the CIO in its planning efforts. As such, the department lacks the structure and mechanisms needed to plan, manage, and oversee actions for establishing the network. Until HHS adheres to its own guidance for managing the IT resources necessary to improve electronic information-sharing capabilities of systems and networks in use by public health entities throughout the country, it will likely continue to fall short in its efforts to establish the nationwide public health situational awareness network required by PAHPRA.
section_title: What GAO Recommends
paragraphs: GAO is recommending that HHS complete a plan that includes all actions for establishing the network, develop a project management plan that identifies measurable steps for completing the actions, and conduct IT management processes according to CIO guidance. HHS had no comments on the report or recommendations.

section_title: Letter
paragraphs: A catastrophic public health situation—such as a widespread disease  outbreak—could threaten our national security, weaken our economy,  cause hundreds of thousands of casualties, and damage public morale  and confidence. Recent events, such as last year’s massive flooding in  Louisiana and the Zika virus outbreak, draw attention to the need for  public health officials to be able to access real-time information about  emerging threats to enable them to make timely, responsive decisions.
Public health officials rely on information from a number of key  components to create the situational awareness they need to prepare for  and respond to a disease outbreak, environmental threat, or other public  health emergency. The components include critical response resources,  medical care capacity, environmental threats, and the preparedness  status of the many public health jurisdictions across the country. In  addition, information about health-related events provided by data  collection and analysis conducted through biosurveillance techniques is  needed to support early detection of disease outbreaks by public health  officials, thus enabling more efficient and appropriate emergency  preparedness and response.
Since 2006, Congress has mandated that the Department of Health and  Human Services (HHS) take steps toward improving the nation’s  awareness of threats related to public health emergencies. Specifically,  the Pandemic and All-Hazards Preparedness Act (PAHPA)  called for  improvements in public health situational awareness techniques. This act  recognized the need for efficient sharing of real-time information to help  prevent the devastating consequences that could result from a public  health emergency. To address this need, the act required HHS to develop  a strategy for establishing a near real-time electronic nationwide public  health situational awareness capability through an interoperable network  of systems. The network was to share data and information to enhance  early detection of, rapid response to, and management of potentially  catastrophic infectious disease outbreaks and other public health  emergencies that originate domestically or abroad. HHS was required to  establish such a network in collaboration with state, local, tribal, and  territorial public health entities. The 2006 law also required us to report on  HHS’s efforts to develop a strategy for establishing the network.  Accordingly, we reported in December 2010 that the department had not  taken the actions required by PAHPA.
The requirements for HHS to establish the electronic public health  situational awareness network were reiterated in the Pandemic and All- Hazards Preparedness Reauthorization Act of 2013 (PAHPRA).  In  addition to the requirement that HHS develop a strategy for establishing  the network, this law required the department to develop an  implementation plan that was to accompany such a strategy. The plan  was to define the actions that would need to be taken to establish the  network.
Further, this law required us to report on HHS’s efforts. Accordingly, our  objective for this review was to determine what progress HHS has made  toward establishing the electronic situational awareness network  capabilities required by the law.
To address the objective, we focused on steps taken by HHS since our  2010 report toward establishing electronic public health situational  awareness capabilities required by PAHPRA.  In particular, to determine  the progress made by HHS toward establishing the network, we obtained  and reviewed the strategy and implementation plan that the department  developed to address the PAHPRA mandate. We compared the contents  of the implementation plan to the requirements defined in the act to  determine the extent to which the requirements were included in the plan.  In doing so, we analyzed actions described in the implementation plan to  determine which were related to the development of new IT capabilities or  enhancements to existing systems that would be needed to establish the  network capabilities. We focused our review on those actions.
To determine the progress made toward establishing the network, we  examined documentation provided by HHS that reported the steps the  department has taken to address the actions described in the  implementation plan, including the development of systems and  information-sharing tools intended to enhance public health situational  awareness. We also reviewed documentation that provided detailed  information about the systems, such as stakeholders and sources of the  data collected and shared by the systems. We compared HHS’s  implementation plan to departmental guidance for managing enterprise IT  resources and investments. Such guidance included requirements  reflected in the statutory provisions commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA).
To supplement our analysis of the documentation collected from HHS, we  held discussions with officials in HHS’s Office of the Assistant Secretary  for Preparedness and Response (ASPR). These officials were  responsible for completing the strategy and implementation plan and,  thus, were knowledgeable of the actions that had been taken to establish  the network capabilities required by PAHPRA. We also held discussions  with an official of the National Preparedness and Response Science  Board, a federal advisory committee of HHS, to obtain additional  information regarding the steps the board took to provide HHS guidance  and recommendations for enhancing biosurveillance systems in  accordance with the law.
While the scope of our work refers to “public health situational  awareness,” HHS’s plans address “medical situational awareness” as a  distinct component of public health situational awareness. According to  HHS officials, they added the reference to “medical” situational  awareness in the strategy and plan to include network capabilities  specifically related to medical response in cases of public health  emergencies. Throughout this report, we use “public health situational  awareness” without the intention of excluding the “medical” component.  Additional details on our objective, scope, and methodology are  discussed in appendix I.
We conducted this performance audit from February 2016 to September  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Public health functions in the United States—such as disease detection,  vaccinations, and emergency preparedness and response—are  conducted by public health officials from 59 state and territorial health  departments;  approximately 3,000 county, city, and tribal health  departments; about 180,000 public and private clinical laboratories; and  multiple federal agencies. Since clinicians at the county, city, or tribal  level are most likely to be the first ones to detect an incident, they and  local public health officials are expected to report an incident or  symptoms of diseases to the state health department and other  designated parties. States provide supporting personnel, financial  resources, laboratory capacity, and other assistance to local responders  when needed. When an incident occurs that exceeds or is anticipated to  exceed state, local, or tribal resources, state governors may request that  the federal government provide resources to assist the state in its  response efforts.
For incidents involving primarily federal jurisdictions or authorities (e.g.,  military bases, federal facilities, or federal lands), federal departments  and agencies may be the first responders and first line of defense in  coordinating activities with state, local, and tribal partners. Along with  HHS, several other federal agencies play a role in supporting public  health functions, including the Departments of Agriculture, Homeland  Security, Defense, and Veterans Affairs. Among these, HHS is the  department with primary responsibility for supporting public health  emergency preparedness and response: it serves as the federal focal  point for coordinating response support for public health and medical  services. Figure 1 provides an overview of the public entities having roles  and responsibilities in sharing information to support nationwide public  health situational awareness.
Because of the many participants involved, the identification and  management of a public health emergency call for effective  communication and collaboration across all levels of government and the  public health community. In this regard, efficient information sharing  among these entities is essential to create and maintain the situational  awareness needed to effectively prepare for, respond to, and manage a  public health emergency.
subsections: section_title: Overview of the Pandemic and All-Hazards Preparedness Act and the Pandemic and All-Hazards Preparedness Reauthorization Act of 2013
paragraphs: Congress recognized the importance of HHS’s role in supporting the  nation’s ability to prepare for and respond to public health emergencies  and, in 2006, through provisions of PAHPA, established the Office of  ASPR.  Among other things, the Assistant Secretary of this office serves  as the principal advisor to the Secretary of HHS on all matters related to  federal public health and medical preparedness and response. This  official is also responsible for coordinating with state, local, tribal, and  territorial officials to ensure effective integration of federal public health  and medical assets during emergencies. The office was established in  December 2006 and is made up of six subordinate offices.
In addition, PAHPA established the National Biodefense Science Board in  2006, which HHS now refers to as the National Preparedness and  Response Science Board.  This board is to provide expert advice and  guidance to the Secretary on scientific, technical, and other matters  regarding current and future chemical, biological, nuclear, and  radiological agents.
PAHPA also mandated that the Secretary of HHS develop and submit to  the appropriate committees of Congress by June 16, 2007, a strategic  plan that described the steps the department would take to develop,  implement, and evaluate an electronic public health situational awareness  network. The network was to be made up of interoperable systems that  would enable the simultaneous sharing of information needed to enhance  awareness at the federal, state, local, tribal, and territorial levels of public  health. The strategy was to identify measurable steps the Secretary  would take to develop, implement, and evaluate the network. It was also  to identify actions for improving information sharing, coordination, and  communication among disparate biosurveillance systems supported by  HHS. The law required the department to establish such a network by  December 19, 2008. The Secretary designated ASPR to be responsible  for developing the public health situational awareness strategy.
However, we reported in December 2010 that the Secretary of HHS had  not met the requirements enacted by PAHPA in 2006.  In particular, we  found that the department had not developed a strategic plan for  establishing the network and had not integrated relevant but disparate  strategies that existed throughout the department as a step toward  establishing an electronic public health situational awareness network.  Thus, we recommended that the Secretary of HHS develop and  implement a strategic plan that defined goals, objectives, and priorities for  establishing an electronic public health situational awareness network.  We noted that such a plan should include performance measures for  evaluating capabilities of existing and planned information systems,  identify gaps in information-sharing capabilities and needed areas of  improvement, and integrate related strategies within HHS for sharing  information among federal, state, local, and tribal entities. The department  neither agreed nor disagreed with the recommendation, but stated that a  complete strategy would be developed.
Subsequently, Congress reauthorized the act in 2013 and reiterated the  mandate for HHS to develop a strategy and implementation plan for  establishing an electronic public health situational awareness network,  and to establish the network. The reauthorization, or PAHPRA, required  the Secretary of HHS to submit to the appropriate committees of  Congress a coordinated strategy and an accompanying implementation  plan no later than 180 days after March 13, 2013—that is, by September  9, 2013. The network was to be established by March 13, 2015. PAHPRA  authorized $138,300,000 for each of fiscal years 2014 through 2018 to  support HHS’s efforts to implement the network and other activities  mandated by the act.
In May 2014, ASPR officials completed and the Secretary of HHS  submitted the Public Health and Medical Situational Awareness Strategy  to Congress. The department submitted the accompanying  implementation plan to Congress in September 2015. Figure 2 provides  an overview of the submission requirements and delivery time frames of  the strategy and plan.
section_title: Use of Information Technology to Support Public Health Situational Awareness
paragraphs: Maintaining a situational awareness capability involves an active,  continuous, and timely exchange of information that enhances the ability  of public health officials to make decisions related to emergency  preparedness and response. For about two decades, public health  officials at the federal, state, local, tribal, and territorial levels have used  IT systems and tools to collect and share information in their day-to-day  functions, such as tracking vaccinations and outbreaks of seasonal  influenza.
Public health officials also use these systems to create the situational  awareness needed to enable early detection of, and effective response  to, emerging diseases and other public health events. For example,  electronic biosurveillance systems are used to collect data such as  complaints from emergency department patients and lab test results  related to disease syndromes, and to provide these data to public health  officials. These data collection and information-sharing techniques are  employed not only to detect the initial signs of emerging threats, but also  to track the spread of syndromes, diseases, and other biological events  throughout the duration of a public health emergency. Additionally,  geographic information systems and mapping tools that support  emergency response are useful to public health officials, as these tools  provide visual and quantitative data such as maps of available hospital  facilities and bed capacity, the location of electrical grid generators, and  information regarding regional populations.
At the federal level, several agencies have implemented and continue to  use IT systems and tools as part of their efforts to collect, integrate, and  share critical public health and medical information. In our December  2010 report, we described 25 systems in use by HHS’s Centers for  Disease Control and Prevention (CDC), Food and Drug Administration  (FDA), Indian Health Service, and the Office of ASPR to support public  health situational awareness.  These systems had been developed and  implemented to enable emergency response information-sharing in  support of various other public-health-related department initiatives or  mandates.
In its role as the federal focal point for coordinating response support for  public health and medical services, HHS coordinates national emergency  response efforts for public health emergencies through ASPR’s  Secretary’s Operations Center (SOC). This center was established in  2002 primarily in response to the events of September 11, 2001. The  SOC is a 24-hour-a-day, 7-day-a-week emergency operations center that  uses information systems and tools to collect and analyze data from other  federal emergency operations centers, such as those at CDC and FDA.   The systems are also used to share information with other federal  agencies that have responsibility for public health and other emergency  support functions, such as the Departments of Homeland Security,  Agriculture, and Transportation, and with state and local entities.
ASPR officials stated that they have used information systems operating  from the SOC to support situational awareness during recent  emergencies. For example, during the Louisiana flooding in August 2016,  HHS deployed regional teams to the field to collect public health data  from electronic health records of patients injured or otherwise affected  during the flooding. The teams integrated the data into one of the SOC  analytical tools, called Fusion Analytics, which layered the patient data  with other data, such as information regarding the location of medical  facilities that were available and able to treat certain patients.  The HHS  teams were then able to provide the information to local public health  officials to help them make decisions regarding where to transport victims  for treatment.
In addition, the department used maps and images produced by another  system, the HHS emPOWER Map, to identify populations of Medicare  beneficiaries who use electricity-dependent medical equipment, such as  ventilators and powered wheelchairs. This information was used to  support planning and response efforts in the field in case of a power  outage. The system also provided graphical information about areas likely  to flood in support of emergency responders making preparations. Figure  3 shows an example of the type of information provided by emPOWER  Map.
ASPR officials noted other ways in which HHS has used IT systems  operating from the SOC to help provide situational awareness for the  early detection of illnesses in the Zika virus outbreak during the summer  of 2016. For example, HHS used its interactive geographical information  system tool, called GeoHEALTH, to map the number of cases within the  country by state and county. This information was collected from state  and local public health officials via CDC’s disease surveillance systems  and from the National Biosurveillance Information Center via open source  reporting. Using GeoHEALTH, HHS also mapped areas where potential  contraceptive access issues could exist based on a number of key  factors, including counties with high uninsured rates of women of  childbearing age. Another way that GeoHEALTH was used in support of  Zika monitoring was to map laboratory capacity for disease testing, as  well as areas that were screening for Zika in the blood supply. The maps  provided information to public health officials that enabled them to  determine, for example, whether a jurisdiction had the medical facilities,  lab capacity, resources and medications, and expertise needed to  effectively respond to the outbreak. Figure 4 shows an example of a map  produced by GeoHealth.
ASPR also allows public health entities at the state, local, tribal, and  territorial levels to use its systems to collect data. The data are used by  these other entities to supplement or enhance information collected from  the systems and tools used within their jurisdictions to support  biosurveillance, public health reporting, and emergency response  operations.
Other HHS systems are also available for use by public health entities  throughout the country. For example, CDC developed and implemented  the BioSense system, which is used not only by its own program and  Emergency Operations Center staff, but also by public health staff at state  and local health departments and the Department of Veterans Affairs.   The system was designed to collect health data from sources such as  hospitals, laboratories, and pharmacies, and to provide public health  entities access to the data. Such data are needed to create and support  situational awareness, and thus improve capabilities for early public  health emergency preparedness and response.
section_title: HHS’s Processes for Managing and Overseeing IT Resources and System Development
paragraphs: HHS has defined processes and practices for managing the department’s  collection of IT systems and resources under the governance of an  established organization. This IT portfolio includes the systems used by  the department to support public health situational awareness.
Specifically, within HHS, the Office of the Chief Information Officer (CIO)  defined processes for managing the IT portfolio when it published the  Enterprise Performance Life Cycle Framework in July 2012. The  framework was developed to guide the management of department IT  resources in a way that facilitates participation with HHS partners.   According to the framework, an IT project may be triggered as a result of  business process improvement activities, changes in business functions,  advances in IT, or it may arise from a law, such as the mandated  establishment of electronic network capabilities defined by PAHPA and  PAHPRA.
The framework defines roles, responsibilities, and activities required to  manage IT initiatives, to include those of business owners, critical  partners, and integrated project teams.
The business owner is the executive in charge of the organization and  serves as the primary customer and advocate for an IT project. The  business owner is responsible for identifying the business needs and  performance measures to be satisfied by an IT project; providing  funding for the project; establishing and approving changes to cost,  schedule, and performance goals; and validating that the project  initially and continually meets business requirements. In the case of a  legislatively mandated program, when certain requirements and  business needs are largely pre-determined, a business owner and IT  project manager still must demonstrate that a proposed project will  meet requirements stated in the mandate and do so in the optimal  manner.
Critical partners for an IT project are functional managers in areas  such as enterprise architecture, security, acquisition management,  finance, budget, and human resources. The critical partners are  considered subject matter experts and participate in project  management reviews and governance decisions to ensure  compliance with policies in their respective areas.
The integrated project team is chaired by an IT project manager with  critical partner and business owner representatives to assist with  planning and execution of the project.
Further, HHS’s Enterprise Performance Life Cycle Framework defines the  IT governance organization that will be responsible for ensuring that IT  projects are technically sound, follow established project management  practices, and meet the business owner’s needs. Components of this  governance organization are an Information Technology Investment  Review Board, the CIO’s Council/Technical Review Board, and the  department’s CIO.
In December 2014, FITARA enhanced the level of involvement that  department CIOs should assume regarding the decision processes and  policies related to IT resources implemented throughout the department,  including those within programs such as those for public health  emergency preparedness and response.  Among other requirements,  FITARA states that the CIO of a covered department such as HHS shall  be included in the internal planning processes for how the department  uses IT resources to achieve its objectives. This includes CIO  involvement in planning for IT resources at all points in their life cycle.
On June 10, 2015, the Office of Management and Budget (OMB)  released a memo that provides federal agencies guidance for enhancing  CIO responsibilities and involvement with IT resources in accordance with  FITARA.  The guidance states that the CIO shall approve the IT  components of any plans through a process defined by the department  head. The guidance also states that the CIO should establish and  maintain a process to regularly engage with program managers to  evaluate IT resources supporting each strategic objective. HHS updated  its Enterprise Performance Life Cycle Framework IT guidance and  governance approach to incorporate the FITARA requirements in October  2016.
section_title: Prior GAO Reports Highlighting HHS’s and Other Agencies’ Efforts to Share Electronic Information for Public Health Emergency Preparedness and Support
paragraphs: Although public health entities at the federal, state, and local levels have  been using IT systems to support their day-to-day and emergency  preparedness and response efforts for about 20 years, they have  encountered obstacles in efforts to implement effective and timely  electronic sharing of information on a nationwide basis. In addition to the  December 2010 report previously discussed, we have issued multiple  other reports since 2003 on the need for federal agencies—primarily  HHS—to develop strategies and plans for coordinating public health IT  initiatives. These include the implementation of IT systems and data- sharing networks among federal, state, and local public health entities. In  these reports, we have described challenges related to sharing data  among public health entities, including the lack of an overall strategy to  guide the establishment of interoperability among related systems.  We  also have described issues related to benefits versus costs of collecting  and integrating public health data at the federal level, and questions  regarding the usefulness of such data. Specifically, we described state  and local public health officials’ concerns regarding the cost and effort  associated with providing data to federal entities to be integrated and  shared on a nationwide basis, and whether those integrated data  enhanced public health officials’ ability to prepare for and respond to  emergencies.
In 2003, we evaluated and reported on federal agencies’ efforts to  develop IT to support public health emergency preparedness and  response. In our report, we identified issues regarding the  implementation of health care and public health IT standards and the lack  of an overall strategy to guide IT development and initiatives. As a result  of the deficiencies we reported, we recommended that the Secretary of  HHS, in coordination with other key stakeholders—such as the  Secretaries of Defense and Veterans Affairs—establish a national IT  strategy for public health preparedness and response. HHS, through  activities initiated by the Office of the National Coordinator for Health IT,  took steps to implement this recommendation by establishing  interoperability standards and addressing privacy concerns as part of its  efforts to advance the nationwide implementation of health care IT.
In a June 2005 report, we evaluated the progress of federal agencies on  their major public health IT initiatives, including one broad initiative at  CDC—the Public Health Information Network—that is intended to provide  the nation with integrated public health information systems to support  activities such as disease detection, tracking, outbreak management, and  exchange of laboratory information.  We reported that CDC and the  Department of Homeland Security faced challenges related to the  planning and implementation of IT initiatives, including a need for  improvements in systems integration and interoperability, and  coordination with state and local public health agencies. Based on the  concerns we identified, we recommended that the Secretary of HHS  ensure that the federal initiatives were (1) aligned with the national health  IT strategy, the federal health architecture, and other ongoing public  health IT initiatives and (2) coordinated with state and local public health  initiatives. We also recommended that the Secretary ensure that federal  actions taken to encourage the development, adoption, and  implementation of health care data and communication standards across  the health care industry address interoperability challenges associated  with the exchange of public health information. The department  addressed our recommendations by including public health IT initiatives  within its overall strategy for nationwide health IT and by defining other  initiatives for improving the exchange of clinical and public health data  among public and private health care sectors.
In November 2008, we reported on a key HHS syndromic surveillance  program—the CDC’s BioSense program.  We reported that CDC had not  identified annual and long-term cost and timeline estimates and  performance measures for implementation of its redesigned BioSense  program. We recommended that the Director of CDC develop reliable  cost and timeline estimates for implementing the BioSense program and,  with stakeholder input, develop outcome-based performance measures.  HHS subsequently took steps to implement the recommendations.  Specifically, CDC initiated activities to define the estimates and worked  with a panel of state and local stakeholders to define performance  measures that are focused on the intended results of the program.
section_title: HHS Has Made Limited Progress toward Establishing the Public Health Situational Awareness Network Capabilities Required by PAHPRA
paragraphs: The Public Health and Medical Situational Awareness Strategy that HHS  developed included several objectives and strategies for establishing the  network required by PAHPRA. The accompanying implementation plan  identified specific actions for accomplishing the objectives. However, the  actions identified in the implementation plan did not address all of the  requirements defined by the law, including the identification of  measurable steps to guide efforts in completing the actions. In the  absence of an implementation plan that addressed these critical  elements, as of May 2017, HHS had made limited progress toward  establishing the required electronic public health situational awareness  network capabilities. In addition, HHS did not follow established IT  planning and management processes, which has further impeded the  department’s ability to make progress toward establishing the network.
subsections: section_title: HHS Identified Actions for Establishing the Network, but Did Not Address All PAHPRA Requirements Nor Define Measurable Steps to Guide its Efforts
paragraphs: PAHPRA required HHS to conduct four activities related to the  establishment of the public health situational awareness network.  Specifically, the law required the department to (1) define minimal data  elements for the network; (2) use applicable interoperability standards to  facilitate information exchange among public health entities; (3)  collaborate with state, local, and tribal public health officials to integrate  and build on existing capabilities to ensure simultaneous sharing of data,  information, and analyses from the network; and (4) collaborate with  state, local, and tribal public health officials to develop procedures and  standards for the collection, analysis, and interpretation of data that  states, regions, or other entities collect and report to the network.
According to PAHPRA, the network was to incorporate data elements  from three types of public health information providers: (1) state, local,  and tribal health entities; (2) federal health agencies; and (3) zoonotic  disease monitoring systems. The law also identified other data to be  integrated into the network, if practicable, from other types of providers,  including, hospitals, pharmacies, and poison control centers.
HHS stated in its Public Health and Medical Situational Awareness  Strategy a primary goal for achieving effective public health situational  awareness—to protect human health, safety, and well-being by  enhancing the nation’s operational capability to support decision making  at all government levels and across critical infrastructure sectors before,  during, and after an incident. HHS defined five objectives for  accomplishing the goal and further described objective-level strategies  that were to contribute to accomplishing each of the objectives.  The five  objectives and objective-level strategies are supported by 49 intended  actions that are outlined in the accompanying implementation plan.
While not all of these objectives, strategies, and actions are directly  related to the development of IT capabilities needed to establish the  electronic public health situational awareness network required by  PAHPRA, we identified ten specific IT-related actions in the  implementation plan that support three objectives and four strategies that  are significant to achieving nationwide information-sharing capabilities to  meet the law’s requirements. These objectives, strategies, and actions  are summarized in table 1.
Relative to PAHPRA, six of the 10 IT-related actions in the  implementation plan address two of the four activities required by the law.  Specifically, actions to improve health information exchanges (3.1.3) and  to, where possible, innovate and improve the functional compatibility of  health information systems (3.1.4) address the PAHPRA requirement to  use interoperability standards. Further, four actions in the implementation  plan address the requirement in the law that called for collaborating with  public health officials at all levels to integrate and build on existing  network capabilities: implement mechanisms for routine inter-disciplinary  and interdepartmental health information sharing (2.2.3),  comprehensively review and evaluate existing and planned data systems  (3.3.1), inventory regional health information organizations and  exchanges (3.3.2), and develop the capability to house, share, and  appropriately use information related to public health situational  awareness (3.3.6).
Further, with regard to the sources of data for the network, the IT-related  actions discussed in the implementation plan include two that support the  collection of data from the three types of providers defined in PAHPRA.  Specifically, actions 2.2.2 and 2.2.3 are intended to identify the collection  of data from federal and non-federal partners, to include data related to  zoonotic diseases.
However, the implementation plan does not include actions that would  address two other activities required by the law. Specifically, the plan  lacks any actions to address a required activity for defining the minimal  data elements needed to establish the network, and another activity for  collaborating with public health officials to develop standards for  interpreting and reporting on data collected by the network. When  reporting on barriers to meeting requirements of PAHPRA, HHS  described challenges related to the definition of essential data elements  and the establishment of standards to enable system interoperability.  Accordingly, ASPR officials did not include in the implementation plan any  specific actions related to defining the minimal data needed or  establishing applicable standards for the network.
Table 2 summarizes the required activities and network data providers  defined by PAHPRA, and actions included in the implementation plan that  address the requirements of the law.
Lacking the specific actions to define the minimal data elements needed  from the sources and to develop standards for sharing the data in  collaboration with state, local, and tribal public health officials, the  implementation plan’s usefulness for ensuring that needed information is  available to be shared in a standardized format and can be used by public  health officials throughout the nation is diminished. Moreover, until HHS  addresses all activities required by PAHPRA in its implementation plan,  the department will not be able to ensure that public health situational  awareness network capabilities will be established in accordance with all  the requirements defined by the law.
subsections: section_title: HHS’s Implementation Plan Does Not Identify Measurable Steps to Meet Requirements of PAHPRA
paragraphs: PAHPRA required HHS to identify measurable steps the Secretary would  carry out to guide the efforts to develop, implement, and evaluate the  network. Further, the law required the National Preparedness and  Response Science Board to assist HHS in its planning efforts by  providing expert advice and guidance, including recommendations,  regarding the measurable steps the Secretary should take to modernize  and enhance public health situational awareness information sharing  capabilities through a biosurveillance network. To define measurable  steps for IT projects, OMB guidance notes that implementation plans  should include a timeline of tasks and steps toward implementing  requirements; an estimate of costs to implement the tasks; resource  requirements; and performance metrics to be used to determine whether  tasks are completed on time and within resource requirements, and  whether they result in the expected outcomes.
However, the implementation plan that HHS developed does not identify  timelines, estimates of cost and resource requirements, or performance  metrics that can be used to track and measure progress made toward  completing tasks and, thus, to determine whether expected progress and  outcomes of the IT-related actions are being achieved. For example,  actions included in the plan to enhance existing information-sharing  networks in support of public health situational awareness are defined to  be taken within a broad time frame—between 2016 and 2018—but do not  include metrics, such as interim milestones for completing specific tasks,  that could be used to monitor and measure progress toward completing  the actions. Further, the plan does not identify cost estimates to  implement the actions or any performance metrics to determine whether  the outcomes of the actions deliver expected benefits on time and within  cost, as suggested by OMB guidance.
HHS officials also did not identify in the implementation plan specific  resource requirements and responsibilities for taking the actions identified  in the plan. For example, although the plan identifies HHS and state,  local, tribal, and territorial stakeholders as the lead entities for taking a  number of the actions, and the Departments of Homeland Security,  Defense, and Veterans Affairs as participating entities, it does not  designate identifiable contacts, such as particular offices within the  departments or stakeholder contacts within the many public health  entities identified in the plan.
In addition, HHS officials did not include in the implementation plan any  measurable steps related to the enhancement of public health situational  awareness information sharing capabilities through a biosurveillance  network, as required by the law. While the National Preparedness and  Response Science Board provided to HHS a number of  recommendations related to the integration of biosurveillance systems  and information, it did not identify and recommend the specific tasks and  the timelines, estimates of cost, and resources requirements necessary to  achieve a national biosurveillance system based on existing state,  regional, and community level capabilities. Instead, the board  recommended that HHS establish a central authority within the  department to define the measurable steps for achieving these  capabilities.
ASPR officials stated that they did not identify measurable steps for  completing the actions identified in the implementation plan because they  created the National Health Security Strategic Guidance Committee in the  summer of 2016 to be responsible for developing the measures and  overseeing the conduct of the actions, including those related to  biosurveillance. However, the National Health Security Strategic  Guidance Committee charter does not include any responsibilities related  to defining steps or overseeing the actions for establishing the network,  and, as of May 2017, the committee had not done so.
Because HHS did not identify measurable steps, in accordance with  PAHPRA and OMB guidance, it lacks key planning elements needed to  ensure the actions are taken to develop the network. Moreover, until the  department defines such steps, it will not have the information and  planning tools it needs to make progress toward establishing the network  required by PAHPRA.
section_title: HHS Reported Limited Progress in Taking Actions Defined in the Implementation Plan to Develop the Network
paragraphs: In the absence of an implementation plan that addresses all of the  activities required by PAHPRA, the department has made limited  progress toward establishing the public health situational awareness  network. HHS issued a report in January 2017 that was intended to  provide an update on the status of the actions identified in its  implementation plan. The report discussed the outcomes from one  action that had partially addressed the third objective of the  implementation plan—to evaluate existing network capacity to ensure it is  leveraged where appropriate and that new capacity is promoted where  needed. Specifically, the report described existing capacity within the  department that supports information sharing among public health  entities. It noted that such capacity is achieved through the use of several  systems that ASPR has implemented and operates within the SOC.  (Appendix II provides an overview of these systems, as described in  HHS’s report.)
While ASPR officials stated that these systems provide information  sharing capabilities required by PAHPRA, they did not take all the actions  that were defined to fully address the third objective of the implementation  plan, including actions 3.1.2, 3.1.3, and 3.1.4. Specifically, they did not  assess network capacity existing among all levels of public health to gain  an understanding of the networks and the contributions each could make  to support nationwide public health situational awareness. The officials  did not identify where interoperability existed or was needed between  systems and networks, or whether integration techniques were needed to  ensure that all relevant information from disparate networks could be  shared.
Further, ASPR officials did not identify and evaluate other federal  agencies’ and state, local, and tribal public health entities’ existing  electronic information-sharing network capabilities, as required by the  law. Although actions for doing so were identified in the plan (actions  3.3.1, 3.3.2, 3.3.5, and 3.3.6), neither ASPR nor any other department  officials had identified electronic information-sharing capabilities existing  among public health entities that could be built upon to establish the  network required by PAHPRA. As a result, outcomes of ASPR’s actions  to evaluate existing capacity did not provide the information needed to  determine what network capabilities already exist throughout all levels of  public health and what system enhancements need to be developed to  establish electronic public health situational awareness capabilities in  accordance with PAHPRA.
HHS’s January 2017 status report also did not address any other IT- related actions identified in the implementation plan for establishing the  network. Specifically, the report did not discuss any actions taken to  address the first and second objectives of the implementation plan and,  therefore, did not reflect the status of HHS’s efforts to create a working  group and develop a set of measures for each action to track progress  toward developing the network capabilities required by PAHPRA.  Likewise, the report does not address the status of any actions taken by  the department to engage federal and nonfederal public health officials to  ensure the information required to establish the network is available.
ASPR officials told us that the development and implementation of the  systems operating in the SOC represent the extent of their efforts that  could address IT-related actions identified in the implementation plan.  They stated that the specific actions outlined in the plan had not been  taken because other public health partners within federal agencies and  state, local, tribal, and territorial entities were designated in the plan to be  responsible for leading and participating in the steps necessary to  complete the actions. A director within ASPR further stated that, while  they are responsible for establishing policy and making plans to address  the PAHPRA mandate, they are not responsible for establishing the  electronic network capabilities other than those provided through the  operation of the systems in the SOC.
However, neither the National Health Security Strategic Guidance  Committee nor any other entity within HHS has taken responsibility to  ensure that actions are taken to establish the network, and to track and  monitor progress of the actions from initiation to completion. Further,  according to ASPR officials, as of May 2017, the department had not  designated funds to be used for purposes of planning for or establishing  the network, and had not accounted for any funds used specifically to  develop the strategy and implementation plan.
section_title: Weaknesses in IT Planning and Management Processes Have also Contributed to the Lack of Progress toward Establishing the Network Required by PAHPRA
paragraphs: Beyond the deficiencies in its plans for implementing the network, HHS  did not follow the department’s overall IT planning and management  processes, which contributed to the lack of progress in establishing the  network. For example, HHS’s Enterprise Performance Life Cycle  Framework defines the CIO’s authority over the department’s collection of  IT systems and resources—its IT portfolio—which includes the systems  within the SOC and other systems used for situational awareness  purposes throughout the department. According to guidance provided by  the framework, the CIO should, therefore, play a key role in managing  and facilitating the department’s efforts to identify and implement any  system improvements needed to enhance electronic public health  situational awareness network capabilities to meet the requirements of  PAHPRA.
The Enterprise Performance Life Cycle Framework also establishes the  roles and responsibilities of an integrated project team to manage an IT  initiative. The team is to be chaired by an IT project manager. Among  other activities, the project manager is responsible for: developing a project management plan to be used as the principal tool  for organizing and managing IT projects; ensuring that all appropriate business stakeholders and technical  experts are involved throughout the life cycle of an IT project; proactively reporting missed project milestones and variances in  percentage of project cost, schedule, and performance; maintaining information on project status, control, performance, risk,  corrective actions, and outlook; planning and conducting phase activities and verifying that the set of  deliverables for the phase is complete; and  conducting formal reviews at specified points in the life cycle of the  project.
The project manager for a statutorily mandated project, such as the  electronic network required by PAHPRA, is to demonstrate that a  proposed project will meet requirements stated in the mandate and do so  in an optimal manner.
The project team is also to include a business owner who is responsible  for activities such as:  identifying the business needs and performance measures to be  satisfied by the project; providing funding for the IT project; establishing and approving changes to cost, schedule, and  validating that the project initially meets business requirements and  continues to meet business requirements; and  conducting a preliminary enterprise architecture  review to determine  any potential duplication or contradictions with other existing projects.
In addition, the department’s IT governance organization, led by the CIO,  is to be responsible for ensuring that IT projects are technically sound,  follow established project management practices, and meet the business  owner’s needs.
However, ASPR officials did not follow the department’s established  processes when developing the implementation plan for the electronic  network required by PAHPRA. Specifically, while ASPR designated the  National Health Security Strategic Guidance Committee to be responsible  for managing and overseeing the actions related to the establishment of  the network, the committee’s authority was not established in accordance  with department guidelines for managing IT resources. In particular, the  committee does not include a project manager, business owner, or the  CIO; rather, it is made up of policy and planning officials from HHS and  other federal agencies. As such, HHS has not established the  management structure needed to oversee the use of IT resources in any  efforts taken to enhance electronic information sharing in accordance with  PAHPRA.
Further, in developing the department’s public health situational  awareness implementation plan, ASPR officials did not take other steps  required by departmental guidance for managing IT projects. For  example, HHS’s Enterprise Performance Life Cycle Framework guidance  calls for an IT project manager to develop a full project management plan  to include costs, schedule, and resource requirements for actions to be  taken. However, an IT project manager was not designated to take  responsibility for defining and implementing any system improvements  needed to enhance electronic public health situational awareness network  capabilities, and no such plan was developed.
Additionally, the framework requires an IT project’s business owner to  establish and approve changes to performance metrics and a project  manager to report variances and delays in meeting performance  milestones. Such actions are needed to track progress made toward  project completion and to ensure that expected performance outcomes  are achieved. However, as noted previously, no performance metrics for  establishing the network have been defined, and HHS did not designate a  business owner to be responsible for tracking any progress made toward  implementing the network capabilities required by PAHPRA.
ASPR officials told us that, because they were tasked by the Secretary to  develop the public health situational awareness strategy and  implementation plan required by PAHPRA, no department entity having IT  management responsibilities was involved. However, had HHS followed  its own departmental guidance for managing IT resources—such as  establishing an IT resource management structure, developing a project  management plan, and defining metrics for tracking performance—the  department would have had the planning tools, resources, and oversight  mechanisms needed to actively pursue efforts to establish the required  network capabilities. Until HHS adheres to departmental guidance for  managing the IT resources necessary to identify and implement  enhancements needed to improve electronic information-sharing  capabilities of systems and networks in use by public health entities  throughout the country, its efforts to establish the nationwide public health  situational awareness network required by PAHPRA will continue to be  hampered.
section_title: Conclusions
paragraphs: HHS officials developed a public health situational awareness  implementation plan that identifies actions to address a number of the  requirements for evaluating and establishing network capabilities defined  by PAHPRA. However, the usefulness of the implementation plan is  diminished because it does not include all activities required by the law or  steps that can be measured to determine whether actions have been  initiated and completed. In the absence of a complete and useful  implementation plan, the department has reported making limited  progress toward establishing the network. Further, HHS did not follow  established departmental processes for managing IT resources in its  planning efforts, which may have contributed to its lack of progress. In  particular, department officials did not call for the establishment of an  integrated project team, in accordance with CIO guidance, for managing  and overseeing the use of IT resources to implement the technical  requirements called for by the law.
The importance of HHS’s responsibility for supporting emergency  preparedness and response at all levels of public health calls for the CIO  to play a key role in managing HHS’s efforts to identify and implement  any system capabilities needed to enhance electronic public health  situational awareness network capabilities. Without leadership of the CIO,  the agency will continue to lack the guidance and oversight needed to  implement a network that provides the electronic information-sharing  capabilities required by PAHPRA. Consequently, HHS will remain unable  to provide Congress reasonable assurance that the outcomes of any  ongoing and future efforts will result in progress towards accomplishing  the goals and objectives for enhanced nationwide public health situational  awareness as envisioned by the law.
section_title: Recommendations for Executive Action
paragraphs: To ensure progress is made toward the implementation of any IT  enhancements needed to establish electronic public health situational  awareness network capabilities mandated by PAHPRA, we are  recommending that the Secretary of HHS direct the Assistant Secretary  for Preparedness and Response to take the following three actions:  1.  Task an integrated project team, made up of an IT project manager  and business owner, with including specific actions in the Public  Health and Medical Situational Awareness Strategy Implementation  Plan for conducting all activities required to establish and operate the  network.  2.  Task the integrated project team with developing a project  management plan that includes measurable steps—including a  timeline of tasks, resource requirements, estimates of costs, and  performance metrics—that can be used to guide and monitor HHS’s  actions to establish the network defined in the plans.  3.  Conduct all IT management and oversight processes related to the  establishment of the network in accordance with Enterprise  Performance Life Cycle Framework guidance, under the leadership of  the HHS CIO.
section_title: Agency Comments
paragraphs: We provided HHS a draft of this report for review and comment. Officials  in the department’s Office of the Assistant Secretary for Legislation  responded that they had no comments on the report’s findings and  recommendations.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: The objective of our review was to determine what progress the  Department of Health and Human Services (HHS) has made towards  establishing electronic situational awareness network capabilities in  accordance with the requirements of the Pandemic and All-Hazards  Preparedness Reauthorization Act of 2013 (PAHPRA).
To address the objective, we reviewed section 204 of PAHPRA to identify  requirements for an electronic situational awareness network, which  includes a strategy for establishing electronic public health situational  awareness capabilities, developing a plan for implementing the strategy,  and incorporating recommendations related to public health situational  awareness planning, made by the National Preparedness and Response  Science Board.
We obtained and reviewed documents related to the implementation of  information technology to enhance public health situational awareness  including HHS’s 2014 Public Health and Medical Situational Awareness  Strategy and 2015 Public Health and Medical Situational Awareness  Strategy Implementation Plan, and the National Preparedness and  Response Science Board’s recommendations published in October 2013.  We compared information documented in the strategy and  implementation plan, and the board’s recommendations, to the required  activities and network elements in the law to determine whether they were  included in the plans for establishing an electronic public health  situational awareness network. We analyzed actions described in the  implementation plan to determine which were significant to the  development of new IT capabilities or enhancements to existing systems  that would be needed to establish the network capabilities. We focused  our study on those actions.
We also reviewed a January 2017 status report related to HHS’s efforts to  address the PAHPRA requirements. As part of our review, we identified  systems that HHS reported had been developed and are currently used  within HHS’s Secretary’s Operations Center to support public health  emergency preparedness and response functions. We examined  descriptions of the systems to identify the data sources accessed for  information sharing within HHS and among other public health entities.  We then compared the data sources to technical requirements defined by  PAHPRA and determined the extent to which the systems were used to  collect and share information in accordance with the law.
We examined HHS’s enterprise lifecycle processes for managing and  overseeing IT resources, along with other guidance provided by the Office  of Management and Budget, to identify the roles, responsibilities, and  authority needed to conduct actions that would need to be completed in  order to implement the IT capabilities described in the plans. We then  compared the contents of the strategy and plan against the department’s  processes and the other federal guidance to determine whether HHS had  addressed key elements of implementation planning and followed  departmental processes for establishing and managing the IT resources  needed to implement the IT-related actions included in the  implementation plan.
To supplement the information we collected from examination of  documentation, we held discussions with HHS officials to better  understand the processes they followed and steps they took to develop  the strategy and implementation plan. We also discussed with them their  responsibilities for establishing the network and the status of any  progress that had been made toward completing actions to address the  mandate. In addition, we interviewed an official of the National  Preparedness and Response Science Board to gain an understanding of  the recommendations made to HHS related to planning efforts to address  the modernization and enhancement of biosurveillance systems, as  required by PAHPRA.
We assessed the reliability of the data we obtained from documented  descriptions of HHS systems by reviewing related technical  documentation and interviewing department officials knowledgeable of  the efforts taken to address the electronic information-sharing  requirements of PAHPRA. We found the data reliable for the purposes of  our report.
We conducted this performance audit from February 2016 to September  2017 in accordance with generally accepted government auditing  standards.  Those standards require that we plan and perform the audit  to obtain sufficient, appropriate evidence to provide a reasonable basis  for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: The Office of the Assistant Secretary for Preparedness and Response’s Situational Awareness Systems
paragraphs: Table 3 provides an overview of the Office of the Assistant Secretary for  Preparedness and Response’s situational awareness systems, the users  they were developed to support, entities that provide data, and the data  the systems were designed to share that are required by the Pandemic  and All-Hazards Preparedness Reauthorization Act of 2013.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Teresa F. Tucker (Assistant  Director), Thomas E. Murphy (Analyst in Charge), Melina I. Asencio,  Christopher G. Businsky, Quintin I. Dorsey, and Nancy E. Glover  contributed to this report.