Information Technology: Federal Agencies Face Challenges in Implementing Initiatives to Improve Public Health Infrastructure
Published: 2005-06-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: It has been almost 4 years since the anthrax events of October 2001 highlighted the weaknesses in our nation's public health infrastructure. Since that time, emerging infectious diseases have appeared--such as Severe Acute Respiratory Syndrome and human monkeypox--that have made our readiness for public health emergencies even more critical. Information technology (IT) is central to strengthening the public health infrastructure through the implementation of systems to aid in the detection, preparation for, and response to bioterrorism and other public health emergencies. Congress asked us to review the current status of major federal IT initiatives aimed at strengthening the ability of government at all levels to respond to public health emergencies. Specifically, our objectives were to assess the progress of major federal IT initiatives designed to strengthen the effectiveness of the public health infrastructure and describe the key IT challenges facing federal agencies responsible for improving the public health infrastructure.
section_title: What GAO Found
paragraphs: Federal agencies have made progress on major public health IT initiatives, although significant work remains to be done. These initiatives include one broad initiative at CDC--the Public Health Information Network (PHIN) initiative--which is intended to provide the nation with integrated public health information systems to counter national civilian public health threats, and two major initiatives at the Department of Homeland Security (DHS), which are primarily focused on biosurveillance. CDC's broad PHIN initiative encompasses a number of applications and initiatives, which show varied progress. Currently, PHIN's basic communications systems are in place, but it is unclear when its surveillance systems and data exchange applications will become fully deployed. Further, the overall implementation of PHIN does not yet provide the desired functionality, and so some applications are not widely used by state and local public health officials. For example, CDC's BioSense application, which is aimed at detecting early signs of disease outbreaks, is available to state and local public health agencies, but according to the state and local officials with whom we spoke, it is not widely used, primarily because of limitations in the data it currently collects. DHS is also pursuing two major public health IT initiatives--the National Biosurveillance Integration System and the Biological Warning and Incident Characterization System (BWICS). Both of these initiatives are still in development. The BWICS initiative, in addition, is associated with three other programs, one of which--BioWatch--is operational. This early- warning environmental monitoring system was developed for detecting trace amounts of biological materials and has been deployed in over 30 locations across the United States. Until recently, its three IT components were not interoperable and required redundant data entry in order to communicate with each other. As federal agencies work with state and local public health agencies to improve the public health infrastructure, they face several challenges. First, the national health IT strategy and federal health architecture are still being developed; CDC and DHS will face challenges in integrating their public health IT initiatives into these ongoing efforts. Second, although federal efforts continue to promote the adoption of data standards, developing such standards and then implementing them are challenges for the health care community. Third, these initiatives involve the need to coordinate among federal, state, and local public health agencies, but establishing effective coordination among the large number of disparate agencies is a major undertaking. Finally, CDC and DHS face challenges in addressing specific weaknesses in IT planning and management that may hinder progress in developing and deploying public health IT initiatives. Until all these challenges are addressed, progress toward building a stronger public health infrastructure will be impeded, as will the ability to share essential information concerning public health emergencies and bioterrorism.

section_title: Letter
paragraphs: It has been almost 4 years since the anthrax events of October 2001  highlighted the weaknesses in our nation’s public health infrastructure.  Since that time, emerging infectious diseases have appeared—such as  Severe Acute Respiratory Syndrome and human monkeypox—that have  made our readiness for public health emergencies even more critical.  Information technology (IT) is central to strengthening the public health  infrastructure through the implementation of systems to aid in the  detection, preparation for, and response to bioterrorism and other public  health emergencies.
You asked us to review the current status of major federal IT initiatives  aimed at strengthening the ability of government at all levels to respond to  public health emergencies. Specifically, our objectives were to  assess the progress of major federal IT initiatives designed to strengthen  the effectiveness of the public health infrastructure and  describe the key IT challenges facing federal agencies responsible for  improving the public health infrastructure.
We selected specific IT initiatives to review from systems we identified in  previous work, focusing on major public health IT initiatives in  surveillance and communication systems. These initiatives were one  broad initiative at the Department of Health and Human Services’ (HHS)  Centers for Disease Control and Prevention (CDC) and five initiatives at  the Department of Homeland Security’s (DHS) Science and Technology  (S&T) Directorate. We also conducted limited work at the Department of  Defense (DOD) because it provides technical support to one of the DHS  initiatives. We also assessed the use of federal public health IT applications  at six state and six local public health agencies. Further details of our  objectives, scope, and methodology are provided in appendix I. Our work  was performed from July 2004 through April 2005, in accordance with  generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: On June 12, 2002, Congress passed the Public Health Security and  Bioterrorism Preparedness and Response Act of 2002, which requires  specific activities related to bioterrorism preparedness and response. For  example, it calls for steps to improve the nation’s preparedness for  bioterrorism and other public health emergencies by increasing  coordination and planning for such events; developing priority  countermeasures; and improving state, local, and hospital preparedness  and response. The Secretary of HHS is required to provide for the  establishment of an integrated system or systems of public health alert  communications and surveillance networks among (1) federal, state, and  local public health officials; (2) public and private health-related  laboratories, hospitals, and other health care facilities; and (3) any other  entities that the Secretary determines are appropriate. These networks are  to allow for secure and timely sharing and discussion of essential  information concerning bioterrorism and other public health emergencies,  as well as recommended methods for responding to such an attack or  emergency. In addition, no later than 1 year after the enactment of the law,  the Secretary, in cooperation with health care providers and state and local  public health officials, was to establish any additional technical and  reporting standards, including those for network interoperability.
Since fiscal year 2002, HHS has funded over $2.7 billion for public health  preparedness efforts through grants administered by CDC and just over $1  billion for hospital preparedness grants administered by the Health  Resources and Services Administration. To encourage the integration of  health care system response plans with public health department plans,  HHS has incorporated both public health preparedness and hospital  performance goals into the agreements that the department uses to fund  state and local public health preparedness improvements. The funding  guidance provided by HHS to state and local governments calls for  improvements in seven key areas:  preparedness planning and readiness assessment,  surveillance and epidemiology capacity,  laboratory capacity for handling biological agents,  laboratory capacity for handling chemical agents,  health alert network/communication and IT,  risk communication and health information dissemination, and  education and training.
Over the past year, federal actions to encourage the use of IT for health  care delivery and public health have been accelerated. In April 2004, the  President established the goal that health records for most Americans  should be electronic within 10 years and issued an executive order to  “provide leadership for the development and nationwide implementation of  an interoperable health information technology infrastructure to improve  the quality and efficiency of health care.” As part of this effort, the  President tasked the Secretary of HHS to appoint a National Coordinator  for Health Information Technology—which he subsequently did 1 week  later. The President’s executive order called for the Coordinator to develop  a strategic plan to guide the implementation of interoperable health IT in  the public and private health care sectors. In July 2004, HHS issued a framework for strategic action that includes four broad goals; goal four of  that framework is directed at improvements in public health.
Further, DHS released the National Response Plan this past January, under  which HHS is to continue to lead the federal government in providing  public health and medical services during major disasters and emergencies.  In this role, HHS is to coordinate all federal resources related to public  health and medical services that are made available to assist state, local,  and tribal officials during a major disaster or emergency.
subsections: section_title: Role of IT in Public Health Preparedness and Response
paragraphs: As we reported in May 2003, IT can play an essential role in supporting  federal, state, local, and tribal governments in public health preparedness  and response. Development of IT can build upon the existing systems  capabilities of state and local public health agencies, not only to provide  routine public health functions, but also to support public health  emergencies, including bioterrorism. In addition, according to the Institute  of Medicine, the rapid development of new IT offers the potential for  greatly improved surveillance capacity. Finally, for public health  emergencies in particular, the ability to quickly exchange data between  providers and public health agencies—or among providers—is crucial in  detecting and responding to naturally occurring or intentional disease  outbreaks.
Because of the dynamic and unpredictable nature of public health  emergencies, various types of IT systems may be used during the course of  an event. These include   surveillance systems, which facilitate the performance of ongoing  collection, analysis, and interpretation of disease-related and  environmental data so that responders and decision makers can plan,  implement, and evaluate public health actions (these systems include  devices to collect and identify biological agents from environmental  samples, and they make use of IT to record and transmit data); and  communications systems, which facilitate the secure and timely  exchange of information to the relevant responders and decision  makers so that appropriate action can be taken.
Other types of IT may also be used, such as diagnostic systems, which  identify particular pathogens and those that include data from food, water,  and animal testing, but such systems are not among the major federal  public health IT initiatives.
section_title: State and Local Roles in Surveillance and Communications
paragraphs: Although state health departments have primary responsibility for disease  surveillance in the United States, total responsibility for surveillance is  shared among health care providers: more than 3,000 local county, city, and  tribal health departments; 59 state and territorial health departments; more  than 180,000 public and private laboratories; and public health officials  from multiple federal agencies. In addition, the United States is a member  of the World Health Organization, which is responsible for coordinating  international disease surveillance and response actions.
While health care providers are responsible for the medical diagnosis and  treatment of their individual patients, they also have a responsibility to  protect public health—a responsibility that includes helping to identify and  prevent the spread of infectious diseases. Because health care providers  are typically the first health officials to encounter cases of infectious  diseases—and have the opportunity to diagnose them—these professionals  play an important role in disease surveillance. Generally, state laws or  regulations require health care providers to report confirmed or suspected  cases of notifiable diseases to their state or local health department.  States publish lists of the diseases they consider notifiable and therefore  subject to reporting requirements. According to the Institute of Medicine,  most states also require health care providers to report any unusual  illnesses or deaths, especially those for which a cause cannot be readily  established. However, according to CDC, despite state laws requiring the  reporting of notifiable diseases, a significant proportion of these cases are  not reported, which is a major challenge in public health surveillance.
Health care providers rely on a variety of public and private laboratories to  help them diagnose cases of notifiable diseases. In some cases, only  laboratory results can definitively identify pathogens. Every state has at  least one public health laboratory to support its infectious diseases  surveillance activities and other public health programs. State laboratories  conduct testing for routine surveillance or as part of clinical or  epidemiologic studies. For rare or unusual pathogens, these laboratories  provide diagnostic tests that are not always available in commercial  laboratories. State public health laboratories also provide specialized  testing for low-incidence but high-risk diseases such as tuberculosis and  botulism. Results from state public health laboratories are used by  epidemiologists to document trends and identify events that may indicate  an emerging problem. Upon diagnosing a case involving a notifiable  disease, local health care providers are required to send the reports to state  health departments through state and local disease-reporting systems,  which range from paper-based reporting to secure, Internet-based  systems.
States, through their state and local health departments, have principal  responsibility for protecting the public’s health and therefore take the lead  in conducting disease surveillance and supporting response efforts.  Generally, local health departments are responsible for conducting initial  investigations into reports of infectious diseases, employing  epidemiologists, physicians, nurses, and other professionals. Local health  departments are also responsible for sharing information that they obtain  from providers or other sources with the state department of health. State  health departments are responsible for collecting surveillance information  statewide, coordinating investigations and response activities, and  voluntarily sharing surveillance data with CDC and others. States vary in  their requirements governing who should report notifiable diseases; in  addition, the deadlines for reporting these diseases after they have been  diagnosed vary by disease. State health officials conduct their own  analyses of disease data to verify cases, monitor the incidence of diseases,  and identify possible outbreaks.
In reporting their notifiable disease data to CDC, states use multiple and  sometimes duplicative systems. States are not legally required to report  information on notifiable diseases to CDC, but CDC officials explained that  the agency makes such reporting from the states a prerequisite for  receiving certain types of CDC funding.
section_title: Federal Role in Surveillance and Communications
paragraphs: Generally, the federal government’s role in disease surveillance is to collect  and analyze national disease surveillance data and maintain disease  surveillance systems. Federal agencies investigate the causes of infectious  diseases and maintain their own laboratory facilities. They also use  communications systems to share disease surveillance information. In  addition, federal agencies provide funding and technical expertise to  support disease surveillance at the state, local, and international levels.
Federal agencies such as CDC, the Food and Drug Administration, and  DOD conduct disease surveillance using systems that gather data from  various locations throughout the country to monitor the incidence of  infectious diseases. In addition to using surveillance systems to collect and  analyze notifiable disease data reported by states, federal agencies use  other surveillance systems to collect data on different diseases or from  other sources (e.g., international sources). These systems supplement the  state data on notifiable diseases by monitoring surveillance information  that states do not collect.
In general, surveillance systems are distinguished from one another by the  types of infectious diseases or syndromes they monitor and the sources  from which they collect data. Some disease surveillance systems rely on  groups of selected health care providers who have agreed to routinely  supply information from clinical settings on targeted diseases. A relatively  new type of surveillance system, known as a syndromic surveillance  system, monitors the frequency and distribution of health-related  symptoms—or syndromes—among people within a specific geographic  area. These syndromic surveillance systems are designed to detect  anomalous increases in certain syndromes, such as skin rashes, that may  indicate the beginning of an infectious disease outbreak. Some monitor  data from hospital and emergency room admissions or data from over-the- counter drug sales. Other data sources may include poison control centers,  health plan medical records, first-aid stations, emergency medical service  data, insurer claims, and discharge diagnosis information. For syndromic  data to be analyzed effectively, information must be timely, and the analysis  must take into account the context of the locality from which the data were  generated.
Because syndromic surveillance systems monitor symptoms and other  signs of disease outbreaks instead of waiting for clinically confirmed  reports or diagnoses of a disease, some experts believe that syndromic  surveillance systems could help public health officials increase the speed  with which they may identify outbreaks. However, as we reported last  September, syndromic surveillance systems are relatively costly to  maintain compared with other types of disease surveillance and are still  largely untested.
section_title: Major CDC and DHS Public Health IT Initiatives
paragraphs: Two federal agencies are involved in major public health IT initiatives that  focus on disease surveillance and communications.
CDC, one of HHS’s divisions, has primary responsibility for conducting  national disease surveillance and developing epidemiological and  laboratory tools to enhance surveillance of disease, including public  health emergencies. It also provides an array of technical and financial  support for state infectious disease surveillance.
DHS’s mission involves, among other things, protecting the United  States against terrorist attacks, including bioterrorism. Its Science and  Technology (S&T) Directorate serves as the department’s primary  research and development arm. Its focus is on catastrophic terrorism— threats to the security of the United States that could result in large- scale loss of life and major economic impact. S&T’s work is designed to  counter those threats, both by improvements to current technological  capabilities and development of new ones. (Other federal agencies’ roles in public health are described in app. II.)
CDC’s major IT initiative, known as PHIN, is a national initiative to  implement a multiorganizational business and technical architecture for  public health information systems. After the 2001 anthrax incidents, CDC  was mandated to increase national preparedness and capabilities to  respond to naturally occurring diseases and conditions and the deliberate  use of all threats, including biological, chemical, and radiological agents.  CDC sees PHIN as an essential part of its strategy to achieve this mandate.
According to CDC, the PHIN architecture  defines and documents the systems needed to support public health   identifies the industry standards that are necessary to make these   develops the specifications necessary to make these standards do the  work of public health;   defines integration points for systems to work together to meet the   establishes tools and components that support standards-based   supports the certification process necessary to establish  interoperability.
To help achieve its goals, PHIN is also intended to integrate and coordinate  existing systems, and CDC makes PHIN software available for optional use  by state and local public health agencies.
PHIN has substantial size and scope, because it is intended to serve as a  comprehensive architecture, information exchange network, and set of  services that will integrate existing capabilities and advance the ways in  which IT can support public health. It is intended to improve public health  systems and networks and to provide a means for exchanging data with  other federal agencies, state and local government agencies, the private  health care sector, and others.
As part of PHIN, CDC has established the PHIN Preparedness initiative,  which it describes as striving to accelerate the pace at which jurisdictions  acquire or acquire access to public health preparedness systems. This  initiative focuses on the near-term aspects of PHIN. According to CDC, the  agency and its public health partners have identified a set of functional  requirements defining the core capabilities for preparedness systems; these  are categorized into six broad functional areas:   Early event detection: The early identification of bioterrorism and  naturally occurring health events in communities.
Outbreak management: The capture and management of information  associated with the investigation and containment of a disease outbreak  or public health emergency.
Connection of laboratory systems: The development and adoption of  common specifications and processes to enable public health  laboratories to electronically exchange information with public health  agencies.
Countermeasure and response administration: The management and  tracking of measures taken to contain an outbreak or event and to  provide protection against a possible outbreak or event.
Partner communications and alerting: The development of a nationwide  network of integrated communications systems capable of rapid  distribution of health alerts and secure communications among public  health professionals involved in an outbreak or event.
Cross-functional components: Technical capabilities, or components,  common across functional areas that are necessary to fully support  PHIN Preparedness requirements.
CDC officials stated that by September 2005, the agency will expect states  to meet PHIN Preparedness requirements in these areas as a condition for  receiving public health preparedness funding; CDC expects that this  condition on funding will promote a wider adoption of PHIN standards.
Table 1 presents communications and surveillance applications that are  part of the PHIN initiative (some of which are significant system  development efforts in themselves), along with the PHIN Preparedness  functional areas that they support.
Many of these applications are associated with larger initiatives that  predated PHIN (see table 2), which are now incorporated under the PHIN  umbrella. For example, the origins of NEDSS date to 1995, when CDC co- authored a report that documented the problems of fragmentation and  incompatibility in the nation’s disease surveillance systems. The  recommendations in this report led CDC to develop the NEDSS initiative,  which was begun in October 1999 and incorporated into PHIN in 2002.
As part of its mission to protect the nation against terrorist attacks  (including possible bioterrorism), DHS is also pursuing major public health  IT initiatives. These initiatives and associated programs, which are  primarily focused on signal interpretation and biosurveillance, are  described in table 3.
Figure 1 illustrates a simplified flow of existing surveillance information  and health alerts among local, state, and federal agencies. This diagram  does not show all flows of information that would occur in the case of an  outbreak. For example, local health agencies may send alerts to health care  providers.
According to CDC, costs for its PHIN initiatives and applications for fiscal  years 2002 through 2005, totaling almost $362 million, are summarized in  table 4. Most of these costs support local, state, and federal public health  activities.
According to DHS, IT costs for its biosurveillance initiatives for fiscal years  2003 through 2005 total about $45 million; these are summarized in table 5.  This table does not reflect the total costs for the programs supporting these  IT initiatives.
section_title: Progress Made in Federal Public Health IT Applications, But More Work Remains
paragraphs: CDC and DHS have made progress on federal public health IT initiatives,  including CDC’s PHIN initiative, which is intended to provide the nation  with integrated public health information systems to counter national  civilian public health threats, and two major initiatives at DHS—primarily  focused on signal interpretation and biosurveillance—one of which is  associated with three other programs. However, while progress has been  made, more work remains, particularly in surveillance and data exchange.  PHIN communications systems are being used, and improvements to  surveillance systems (disease, syndromic, and environmental monitoring)  are still being developed. Other PHIN applications are available for  optional use by state and local public health officials, but they are not  widely used because of system limitations. DHS’s two major  biosurveillance IT initiatives are still in the development stage, and one of  the associated programs—BioWatch—is operational. However, as initially  deployed, BioWatch required modification, because its three IT  components did not communicate with each other, requiring redundant  data entry. According to DHS, it has developed a solution to this  interoperability problem and implemented it at two locations; DHS plans to  install that solution in the remaining BioWatch locations.
subsections: section_title: Projects under CDC’s Public Health Information Network Are in Various Stages of Implementation
paragraphs: Table 6 briefly describes the status of CDC’s PHIN applications, including  operational status, number of installations or users, and future plans. Of  the various PHIN applications, one is still in the planning process, two are  partially operational, and five are operational.
Figure 2 shows the time frames for the planning, development, and  implementation of the PHIN applications; these applications vary  considerably both in complexity and in time needed to complete  implementation.
Health Alerting. The Health Alerting application, which is used to  broadcast e-mail alerts to state and local public health officials about  disease outbreaks, became operational in October 2000. This application  provides full-time (24 hours a day, 7 days a week) Internet access and  broadcast e-mail and fax capabilities.
The Health Alerting application is part of the Health Alert Network  initiative, which provides grant funding to states and local public health  agencies for enhancement of their IT infrastructures. Using these funds,  states and localities have either built their own Health Alert Networks or  acquired commercial systems for alerting state and local officials. Some  state Health Alert Networks use more sophisticated applications than the  CDC Health Alerting application, providing various kinds of alerts based on  user profiles and allowing document sharing.
Epi-X. Epi-X, which is designed to be a secure, Web-based communications  system through which public health professionals share information on  public health emergencies, was implemented in December 2000 and is  being used by state and local public health officials. Epi-X includes multiple  mechanisms for alerting; secure, moderated communications and  discussion about disease outbreaks and other acute health events as they  evolve; and a searchable report database. Most of the state and local health  officials with whom we spoke were satisfied with the system. However,  some officials questioned the need for both Health Alerting and Epi-X,  since both applications have similar functionality and are used by some of  the same public health officials. According to CDC, it is planning to create a  common platform for use by both applications.
subsections: section_title: Two of Three PHIN Surveillance Systems Are Not Yet Fully Operational
paragraphs: The National Electronic Disease Surveillance System (NEDSS). The  NEDSS initiative promotes the use of data and information systems  standards for the development of interoperable surveillance systems at  federal, state, and local levels. It is intended to minimize the problems of  fragmented, disease-specific surveillance systems; however, this goal is still  years away from being achieved.
A primary goal of NEDSS is the ongoing, automatic capture and analysis of  data that are already available electronically. Its system architecture is  designed to integrate and replace several current CDC surveillance  systems, including the National Electronic Telecommunications System for  Surveillance, the HIV/AIDS reporting system, and the systems for vaccine  preventable diseases, tuberculosis, and other infectious diseases. In  previous fiscal years, CDC funded 50 states and 7 localities. These states  and localities can use CDC’s NEDSS Base System or build systems  compatible with NEDSS/PHIN standards. The initiative includes an  architecture to guide states and CDC as they build NEDSS-compatible  systems, which can be either commercial or custom developed. The  initiative is also intended to promote the use of data standards to advance  the development of interoperable disease surveillance systems at federal,  state, and local levels.
Besides providing a secure, accurate, and efficient way to collect, process,  and transmit data to CDC, the NEDSS Base System is intended to provide a  platform upon which program area modules can be built to meet state and  program area data needs. (Programs may be focused on specific diseases,  populations, or other areas—such as smoking or obesity.) Program area  modules are critical to eventually reducing the many program-specific  surveillance systems that CDC currently maintains by consolidating the  data collection of the various programmatic disease surveillance activities  that are currently in place.
Although CDC has been developing the NEDSS Base System since 2000, it  is still only partially deployed. There are no clear milestones and plans for  when the Base System will become fully deployed, although multiple  versions of the Base System have been developed and deployed in several  states. According to CDC, the NEDSS Base System has been deployed in 5  states since December 2004, and it expects implementation to continue  with the 11 remaining states that are planning to use the Base System, but  the implementation time frames will depend on when these states are ready  to accept the system. Table 7 summarizes the status of NEDSS system  implementation across the nation, which shows that about half of the  states and localities have operational NEDSS systems.
In addition, four NEDSS program area modules are being used, and six are  in the process of being developed. Additional program area modules will be  developed for other disease-specific areas in the coming years.
BioSense. CDC’s BioSense, which the agency describes as an early event  detection system, is designed to provide near real-time event detection by  using data (without patient names or medical numbers) from existing  health-related databases. Although CDC began using BioSense data in late  2003, the BioSense application was implemented for state and local use in  May 2004. BioSense is continuously being updated, and current plans for  phase two of BioSense development call for enhancements to begin in May  2005.
BioSense is a Web-based application that currently provides CDC and state  and local users with the ability to view syndromic and prediagnostic data:  specifically, Defense and Veterans Affairs ambulatory care data, BioWatch  laboratory results, and national clinical labs data. Initially, CDC also  provided data on sales of over-the-counter medication, but these were later  discontinued. BioSense data are provided in the form of data reports  displayed in various ways, rather than as raw data that can be input to  analytical systems.
Although CDC uses BioSense for a number of federal bioterrorism  preparedness activities, BioSense is not extensively used by the state and  local public health officials with whom we spoke, primarily because of  limitations in the data and its presentation. These officials stated that the  DOD and VA data were not useful to them, either because they were in  locations without large military or veteran populations, or because they  could get similar data elsewhere. For instance, many of these officials have  access to local syndromic surveillance systems, which better fit their needs  because the systems have better capabilities or because they provide data  that are more timely than BioSense data. Some of these officials stated that  they would prefer CDC to provide data for them to conduct their own  analyses, especially data from national sources such as clinical  laboratories, rather than displaying the data on the BioSense Web site.  According to CDC officials, they will provide raw data to public health  agencies upon request, have increased the number of data sets available,  and have expanded the scope of user support by (1) increasing  communications with state and local public health departments in the use  of and response to daily surveillance data patterns, (2) monitoring data  during special events (e.g., a presidential inauguration and sporting events)  at state and local request, and (3) contracting with John Hopkins University  for development of a standard operating procedure for monitoring and  using early event detection.
National Environmental Public Health Tracking Network (NEPHTN).  Initiated in 2001, NEPHTN is still in the planning stage. CDC is planning to  begin development of the network in 2006 and implementation of phase  one in 2008. This initiative involves intra- and interagency collaboration  among CDC and other federal agencies. CDC established a memorandum  of understanding in 2003 with the Environmental Protection Agency (EPA)  to coordinate activities relating to EPA’s National Environmental  Information Exchange Network and CDC’s National Environmental Public  Health Tracking Network. To date, three collaborative projects have been  initiated: (1) a demonstration project in the Atlanta metropolitan area to  test data linkage methods and utility of linked data; (2) a project to evaluate  how different types of air quality characterization data can be used to link  environmental and public health data; and (3) a project in New York to  examine specific technical interoperability issues that would affect data  exchange between EPA’s and CDC’s networks.
As envisioned, NEPHTN will be a distributed, secure, Web-based network  that will provide access to environmental and health data that are collected  by a wide variety of agencies, such as individual state networks. Once  established, it should also provide access to environmental, health, and  linked environmental-health data from both centralized and decentralized  data stores and repositories, implementing a common data vocabulary to  support electronic data exchanges within states, and across state, regions,  and nationally.
section_title: Two Other PHIN Applications Are Not Widely Used, and One Is in Use but Considered Burdensome
paragraphs: Outbreak Management System. The Outbreak Management System is an  application designed for case tracking during the investigation of disease  outbreaks. Initially developed for use by CDC, the system is now available  for use by state and local public health agencies. The project began as the  Bioterrorism Field Response Application and was scoped to include only  requirements related to bioterrorism response by CDC-deployed field  teams. Since its inception in 2002, the scope has been broadened to include  any epidemiologic investigation where standard data collection and data  sharing would be advantageous. However, although the system is in use at  CDC, none of the state and local public health officials with whom we  spoke use the system—either because it cannot exchange data with other  software applications, or because these agencies have their own capability  for tracing cases of infectious diseases. According to CDC officials, the use  of the Outbreak Management System is provided as an option for state and  local public health agencies. Although only CDC and one state agency have  used the application in support of outbreaks, four state agencies and one  federal entity have evaluated the software for potential use and may  implement it in the future.
LRN Results Messenger. CDC’s LRN Results Messenger utility is used by  DHS’s BioWatch initiative for transmitting data to CDC; however, it is  burdensome to use, according to the BioWatch cities included in our  review (BioWatch is discussed in more detail in the next section of this  report). According to CDC, it anticipates releasing the next version of the  LRN Results Messenger in September 2005, which should address the  usability issues.
PHIN Messaging System. The PHIN Messaging System is available for use,  but only CDC and a few states and local public health agencies use it. As of  March 1, 2005, 51 organizations used it, according to CDC. As yet, only  BioWatch, the NEDSS Base System, and the Laboratory Response Network  use PHIN Messaging; according to CDC, these are the major systems that  support preparedness needs, and it is focusing on these systems first.
section_title: Most DHS Biosurveillance IT Initiatives Are Still in Their Early Stages
paragraphs: DHS is also pursuing two major biosurveillance IT initiatives—the National  Biosurveillance Integration System and the Biological Warning and  Incident Characterization System (BWICS). The BWICS initiative, in  addition, is associated with three other biosurveillance programs. Of these  five, one is operational, but it has interoperability and other limitations, one  is a demonstration project, and three are in development. All five were  initially under the oversight of DHS’s S&T Directorate; one is now the  responsibility of the directorate for Information Analysis and Infrastructure  Protection. Table 8 briefly describes the status and plans of DHS’s  biosurveillance IT initiatives for the current fiscal year.
Most of DHS’s biosurveillance IT initiatives are still being planned or  developed. Figure 3 shows time lines for the five DHS IT initiatives.
The one DHS surveillance initiative that is operational—BioWatch—is an  environmental monitoring system that was developed and implemented  within a 3-month period, according to DHS officials. DHS originally  intended for local public health agencies to process and analyze all  BioWatch data; however, at CDC’s request, DHS agreed to share data with  CDC for inclusion in BioSense. BioWatch consists of three IT components:  One component of BioWatch tracks the environmental samples as they  are collected; it was developed by the Department of Energy’s Los  Alamos National Laboratory.
A second component performs sample testing and reports the results;  this is a commercial product.
The third component, CDC’s LRN Results Messenger, transmits the test  results from the laboratory that processes the samples to CDC for  analysis.
As deployed, none of these three components could exchange data  electronically, so that redundant, manual data entry has been required to  transfer data among the three systems. State and local public health  officials in BioWatch locations told us that they were dissatisfied with the  deployment of BioWatch because of this need for repetitive data entry and  because they were not involved in the system’s planning and  implementation. DHS hired a contractor to resolve BioWatch’s  interoperability problem, and DHS officials now report that they have  begun implementing the resulting technical improvements in BioWatch  laboratories.
Additionally, EPA’s Inspector General’s Office recently reported that the  agency did not provide adequate oversight of sampling operations for  BioWatch to ensure that quality assurance guidance was adhered to,  potentially affecting the quality of the samples taken; DHS officials state  that this oversight issue has now been resolved.
In the broader context of environmental monitoring, questions exist about  detection capabilities for environmental surveillance. As we reported in  May 2003, real-time detection and measurement of biological agents in the  environment is challenging because of the number of potential agents to be  identified, the complex nature of the agents themselves, the countless  number of similar micro-organisms that are a constant presence in the  environment, and the minute quantities of pathogen that can initiate  infection. In May 2004, the Department of Defense reported that the  capability for real-time detection of biological agents is currently  unavailable and is unlikely to be achieved in the near to medium term.
A second initiative, the BioWatch Signal Interpretation and Integration  Program (BWSIIP), was established to respond to user needs regarding  BioWatch. According to DHS, the initiative is intended to develop a system  that will help BioWatch jurisdictions to better understand the public health  or national security implications of a confirmed positive result for a  biological agent from BioWatch, as well as to respond appropriately.  BWSIIP is to be implemented by a consortium, initiated in 2004, that  includes Carnegie Mellon University, the University of Pittsburgh, and the  John Hopkins University Applied Physics Laboratory. The current BWSIIP  pilot is scheduled for completion in fiscal year 2006. After DHS transitions  BWSIIP to the BWICS initiative, local public health agencies will use locally  available applications or tools provided by DHS for that function.
For the two remaining major biosurveillance IT initiatives, DHS is still  developing requirements (lessons learned from its one demonstration  project, BioNet, are being incorporated into BWICS).
BWICS, is to integrate data from environmental monitoring and health  surveillance systems, and the pilot is expected to be completed in fiscal  year 2006, according to DHS officials. DHS did not complete  requirements development in the two pilot cities as scheduled, and it  recently changed one of the original pilot cities, requiring a new start in  requirements development in the new location. After the pilot, DHS is  planning to expand BWICS beyond the two pilot cities to other  BioWatch locations.
The National Biosurveillance Integration System is intended to connect  the various federal surveillance systems to DHS’s Homeland Security  Operations Center. DHS S&T developed the system requirements and  design and transferred the initiative to the Directorate for Information  Analysis and Infrastructure Protection in December 2004 for  implementation.
section_title: Challenges Need to Be Overcome to Strengthen the Information Technology That Supports the Public Health Infrastructure
paragraphs: Despite federal, state, and local government efforts to strengthen the public  health infrastructure and improve the nation’s ability to detect, prevent,  and respond to public health emergencies, important challenges continue  to constrain progress. First, the national health care IT strategy and federal  health architecture are still being developed; CDC and DHS will face  challenges in integrating their public health IT initiatives into these ongoing  efforts. Second, although federal efforts continue to promote the adoption  of data standards, developing such standards and then implementing them  are challenges for the health care community. Third, these initiatives  involve the need to coordinate among federal, state, and local public health  agencies, but establishing effective coordination among the large number  of disparate agencies is a major undertaking. Finally, CDC and DHS face  challenges in addressing specific weaknesses in IT planning and  management that may hinder progress in developing and deploying public  health IT initiatives.
subsections: section_title: National Health IT Strategy and Architecture to Address Public Health Surveillance Are Still Being Developed
paragraphs: In May 2003, we recommended that the Secretary of HHS, in coordination  with other key stakeholders, establish a national IT strategy for public  health preparedness and response that should identify steps toward  improving the nation’s ability to use IT in support of the public health  infrastructure. Among other things, we stated that HHS should set  priorities for information systems, supporting technologies, and other IT  initiatives. Since then, HHS appointed a National Coordinator for Health IT  in May 2004 and issued a framework for strategic action in July 2004. This  framework is a first step in the development of a national health IT  strategy. Goal four of the framework is directed at improvements in public  health and states that these improvements require the collection of timely,  accurate, and detailed clinical information to allow for the evaluation of  health care delivery and the reporting of critical findings to public health  officials. Two of the strategies outlined by HHS are aimed at achieving this  goal: (1) unifying public health surveillance architectures to allow for the  exchange of information among health care organizations, organizations  they contract with, and state and federal agencies and (2) streamlining  quality and health status monitoring to allow for a more complete look at  quality and other issues in real time and at the point of care. The  framework for strategic action states that the key challenge in harmonizing  surveillance architectures is to identify solutions that meet the reporting  needs of each surveillance function, yet work in a single integrated, cost- effective architecture.
Like the national health care IT strategy, the federal health architecture is  still evolving, according to HHS officials in the Office of the National  Coordinator for Health IT. Initially targeting standards for enabling  interoperability, the federal health architecture is intended to provide a  structure for bringing HHS’s divisions and other federal agencies together.  As part of achieving HHS’s public health goal of unifying public health  surveillance architectures, the federal health architecture program  established a work group on public health surveillance that is responsible  for recommending a target architecture related to disease surveillance to  serve as the framework within the federal sector for developing and  implementing public health surveillance systems. The newly formed work  group, chaired by CDC and the Department of Veterans Affairs, met for the  first time in December 2004. Because the new work group is so recently  formed, plans are still being developed to address how CDC’s PHIN  initiative and DHS’s IT initiatives will integrate with the national health IT  strategy, such as plans to establish regional health information  organizations.
In the absence of a completed strategy for public health surveillance  efforts, state and local public health officials have raised concerns about  duplication of effort across federal agencies. Some of the surveillance  initiatives in our review address similar functionality and may duplicate  ongoing efforts at other federal, state, and local agencies: for example, the  use and development of syndromic surveillance systems. CDC is  implementing BioSense at the national level, DHS is assisting local public  health agencies in implementing local syndromic surveillance systems such  as ESSENCE or RODS as part of its biosurveillance initiatives, and many  state and local public health agencies have their own ongoing syndromic  surveillance systems. As we have reported, syndromic surveillance systems  are relatively costly to maintain compared with other types of disease  surveillance and are still largely untested. According to HHS, with regard  to BioSense, the agency is taking steps to mitigate costs and risk.
State and local public health officials also expressed concern about the  federal government’s ability to conduct syndromic surveillance, because  they see this type of surveillance as an inherently local function.  Furthermore, last year the Council of State and Territorial  Epidemiologists reported that while state health departments are given  some guidance and leeway to use federal funding to enhance and develop  their own disease surveillance activities, no focused mechanism has been  established for states to share ideas and experiences with each other and  with CDC to determine what has or has not worked, and what efforts are  feasible and worth expanding. The Council recommended that to enhance  bioterrorism-related surveillance objectives, HHS and CDC form a  bioterrorism surveillance initiative steering committee to review current  federal surveillance initiatives affecting state and local health departments;  to review state-developed surveillance systems; and to recommend  surveillance priorities for continuation of funding, further development, or  implementation. HHS and CDC have taken steps to respond to these  recommendations, but according to the Council, it is not yet satisfied that  HHS and CDC have fully addressed its concerns.
While HHS and other key federal agencies are organizing themselves to  develop a strategy for public health surveillance and interoperability,  decisions regarding development and implementation are being made now  without the benefit of an accepted national health IT strategy that  integrates public health surveillance-related initiatives. In the case of  BioSense, these decisions affect the spending of about $50 million this  fiscal year and an unknown amount in future years. Until a strategy and  accompanying architecture are developed, major public health IT  initiatives will continue to be developed without an overall, coordinated  plan and are at risk of being duplicative, lacking interoperability, and  exceeding cost and schedule estimates.
section_title: Development and Adoption of Standards an Ongoing Critical Challenge for Health Care
paragraphs: In May 2003, we recommended that the Secretary of HHS, as part of his  efforts to develop a national strategy, (1) define activities for ensuring that  the various standards-setting organizations coordinate their work and  reach further consensus on the definition and use of standards,  (2) establish milestones for defining and implementing all standards, and  (3) create a mechanism to monitor the implementation of standards  throughout the health care industry. To support the compatibility,  interoperability, and security of federal agencies’ many planned and  operational IT systems, the identification and implementation of data,  communications, and security standards for health care delivery and public  health are essential. As we testified in July 2004, HHS has made progress  in identifying standards. While federal action to promote the adoption of  these standards continues, the identification and implementation of these  standards are an ongoing process.
Despite progress in defining health care IT standards, several  implementation challenges remain to be worked out, including the  establishment of milestones. Currently, no formal mechanisms are in place  to ensure coordination and consensus among these initiatives at the  national level. HHS officials agree that leadership and direction are still  needed to coordinate the various standards-setting initiatives and to ensure  consistent implementation of standards for health care delivery and public  health. Within the federal health architecture structure, the Consolidated  Health Informatics initiative is focused on the adoption of data and  communication standards to be used by federal agencies to achieve  interoperability of IT within health IT initiatives. In March 2003, the  Consolidated Health Informatics initiative announced the adoption of 5  standards, and in May 2004, it announced the adoption of another 15  standards. Some of these standards are included as PHIN standards.
As of March 1, 2005, CDC has adopted several industry standards and  published specifications for PHIN; these standards are grouped by type in  table 9.
CDC has also initiated a PHIN certification process for its partners (e.g.,  state and local public health agencies), which is intended to establish  whether state and local systems can meet standards for the PHIN  preparedness functional areas. In the future, CDC plans to require system  owners to first perform self-assessment reviews to ensure that systems  meet PHIN standards, followed by reviews by CDC certification teams to  confirm PHIN compatibility. To be functionally compatible, systems must  be capable of supporting the standards outlined for each PHIN functional  area; accordingly, partners must demonstrate that their systems have this  capability.
In general, state and local public health officials consider the PHIN  initiative to be a good framework for organizing the necessary standards  for public health interoperability. Most of the state and local officials we  spoke with agreed that CDC has done a commendable job of adopting and  promoting standards for IT in selected programs. In addition, they agreed  that CDC should continue to take a leadership role in pressing for industry  standards and providing guidance to states and local entities. However,  several officials stated that CDC should focus more of its attention on  setting standards and less on developing software applications, which  generally do not meet their needs and are not compatible with their specific  IT environments. CDC officials say that it is important both to promote the  use of industry standards and to develop software applications, especially  for state and local public health agencies that have limited IT resources.
Although federal efforts to promote the adoption of these standards  continue, their identification and implementation are an ongoing process.  Several implementation challenges remain, including coordination of the  various efforts to ensure consensus on standards and establishment of  milestones. Until these challenges are addressed, federal agencies will not  be able to ensure that their systems can exchange data with other systems  when needed.
section_title: Coordination among Federal, State, and Local Public Health Agencies Is a Major Undertaking
paragraphs: In defining system requirements, federal agencies are challenged by the  need to involve such key stakeholders as state and local public health  agencies, which are expected to use these systems for reporting data to the  federal government. For example, most participating local government  agencies and state public health laboratories were told to implement the  BioWatch initiative in their metropolitan areas and were given the  procedures and software to use for sample management and data  collection. According to some public health officials, BioWatch was  implemented without a plan for how states and localities would respond to  a positive test result, and they were left to develop a response plan after  BioWatch had been deployed. One metropolitan area did not implement  BioWatch for a year after it became operational, because officials did not  have a response plan in place and did not want to be responsible for  responding to a potential incident without a plan for handling positive test  results. According to DHS officials, since local officials had received funds  for emergency preparedness, it was their understanding that BioWatch  locations had response plans in place; DHS officials have since developed a  methodology to target funds for specific purposes, such as response plans.
CDC has been challenged by the need to coordinate with a diverse range of  state and local public health agencies. For example, CDC has found that it  is difficult to implement “standard” systems that would address the full  range of different needs and levels of IT resources available at the state  level. HHS officials told us that the agency strives to address this challenge  by developing applications that are based on industry standards. It also  provides the standards and specifications to state and local agencies so  that they can build or purchase their own systems that can conform to  PHIN standards. Nonetheless, there was consensus among many of the  state and local officials in our review that federal agencies did not obtain  adequate input from state and local officials. A few state officials with  whom we spoke said that CDC does not appropriately consider their need  to comply with existing state IT architectures. In addition, in an informal e-mail survey, a small group of state chief information officers agreed that  federal agencies do not take into consideration state IT architectures.  According to the Council of State and Territorial Epidemiologists, no  mechanism has yet been established for state and federal partners to  collaboratively review initiatives developed over the past 3 years and plan  for the future. Instead, the approach to system design and implementation  remains top-down, mainly focused on expanding federally designed  syndromic surveillance for early outbreak detection without critical review  of its usefulness and cost and without systematic review of state-originated  systems and needs. The result is that public health responders may not buy  in to and use the federally designed systems, potentially constructive state- originated ideas may not get recognition and wider application, and  national bioterrorism-related surveillance will be suboptimal. According to  CDC, as part of its efforts to obtain state and local input, it hosts an annual  PHIN conference and holds meetings with business partner organizations,  such as a recent series of meetings on PHIN preparedness requirements  with selected state and local officials. In addition, under CDC’s new  organizational structure, the new National Center for Public Health  Informatics has a division for communications and collaboration with its  partners.
Further, CDC and DHS have coordinated with each other on specific  projects, but that coordination has not been optimal, according to officials  from both agencies. According to DHS officials, federal agencies are  planning to meet within the next few months to discuss this issue. When  asked about their experiences with coordination between CDC and DHS on  public health IT initiatives, some of the state and local public health  officials included in our review expressed concerns about coordination  between the two agencies; one expressed confusion about their roles.
Until CDC and DHS establish close coordination on federal public health  IT, and state and local public health agencies are more actively involved in  the definition and coordination of federal efforts, the effectiveness of the  information systems intended to improve disease surveillance and  communications may be inadequate.
section_title: Rigorous Planning and Management of IT Initiatives Are Important to Building a Stronger Public Health Infrastructure
paragraphs: A challenge that both HHS and DHS face in implementing public health IT  initiatives is ensuring their effective planning and management. This  requires mature, repeatable systems development and acquisition  processes to increase the likelihood that projects will be delivered on time  and within budget. Key elements of information and technology  management include (1) IT investment management and (2) systems  development and acquisition management. To help federal agencies  address these key elements, we and the Office of Management and Budget  have developed guidance that provides a framework on the use of rigorous  and disciplined processes for planning, managing, and controlling IT  resources. We have previously reported on specific weaknesses at both  HHS and DHS, including the lack of robust processes for IT investment  management and immature systems development and acquisition  practices. We made recommendations to HHS and DHS aimed at  improving these practices.
HHS and CDC have recently taken steps to improve their control over IT  projects, which is an important aspect of IT investment management.  Because PHIN and some of its initiatives (i.e., BioSense, NEDSS, the Health  Alert Network, and NEPHTN) are considered major investments for fiscal  year 2006, they required review by HHS. The HHS IT Investment Review  Board conducted budgetary reviews for these applications in June 2004 and  recommended that the projects move forward as major IT investments;  however, there is no documentation that additional HHS reviews were  conducted on PHIN and its major applications until this past February,  when HHS began implementing procedures for better monitoring of system  development projects. In January 2004, CDC announced its intention to  provide greater executive level oversight of IT investments, but it had been  reorganizing and did not begin conducting control reviews for major PHIN  investments until recently. In May 2004, CDC announced its new center for  public health informatics to better coordinate IT projects; this center was  formally recognized as operational as of mid-April 2005 when Congress  approved CDC’s reorganization. Until CDC and HHS management provides  a systematic method for IT investment reviews, they will have difficulty  minimizing risks while maximizing returns on these critical public health  investments.
Regarding CDC’s systems development and acquisition practices, we  observed weaknesses in project management that may hinder progress  toward achieving PHIN objectives. For some of the projects in this review,  we received limited documentation of project managers’ tracking actual  dates against baseline schedules, and it appeared that a number of projects  had missed internal schedule dates. In November 2004, CDC started  requiring project managers to provide status reports to its program  management activity office on a biweekly basis. These reports are now  required for five of the systems in our review. CDC officials acknowledged  that project dates had to be rebaselined; after the rebaselining, CDC  officials stated that their projects met official release dates.
Early last year, CDC recognized the need for more direct executive  involvement in IT governance and management. This fiscal year, CDC  began implementing a project management office to oversee public health  informatics projects. Establishing this office and institutionalizing its  processes while managing new and ongoing IT projects will be a challenge.  The new office has initiated new processes to manage project  interdependencies, document and track milestones for projects, and  formalize project change requests. For example, the office is beginning to  track projects biweekly—asking project managers to report on upcoming  milestones, their confidence that those milestones will be met, issues for  executive attention, staffing problems, and other potential problems. CDC  is also implementing a process to standardize project management across  the agency. This process is designed to incorporate, among other things,  program and project management, capital planning, security certification  and accreditation, and system development life-cycle processes.
DHS has been operational for just over 2 years, and the department has  made progress in establishing key information and technology disciplines.  However, as we have reported, these disciplines are not yet fully  established and operational. For example, DHS has established an IT  investment management process, but this process is still maturing. DHS  has also had problems consistently employing rigorous systems  development and acquisition practices. DHS did not provide  documentation of its oversight of its public health IT investments.  According to DHS officials, they plan to submit a capital asset plan and  business case for the BWICS initiative this year for review and approval by  the DHS IT review board. However, until DHS follows through on its initial  actions to address its management, programmatic, and partnering  challenges, its IT investments remain at risk.
section_title: Conclusions
paragraphs: The federal government has made progress on major public health IT  initiatives, but significant work remains to be done. CDC’s PHIN initiative  includes applications at various stages of implementation; as a whole,  however, it remains years away from fully achieving its planned  improvement to the public health IT infrastructure. In addition, DHS’s  initiatives are still in such early stages that it is uncertain how they will  improve public health preparedness.
Federal agencies face many challenges in improving the public health  infrastructure. CDC and DHS are pursuing related initiatives, but there is  little integration among them, and until the national health IT strategy is  completed, it is unknown how their integration will be addressed.  Implementing health data standards across the health care community is  still a work in progress, and until these standards are implemented,  information sharing challenges will remain. In addition, state and local  public health agencies report that their coordination with federal initiatives  is often limited. Until state and local public health agencies are more  actively involved in coordination with their federal counterparts, disease  surveillance systems will remain fragmented and their effectiveness will be  impeded. Finally, the development of robust practices for IT investment  management and for systems development and acquisition is a continuing  challenge for HHS and DHS, about which we have previously made  recommendations. Until agencies address all these challenges, progress  toward building a stronger public health infrastructure will be limited, as  will the ability to share essential information concerning public health  emergencies and bioterrorism.
section_title: Recommendations for Executive Action
paragraphs: In order to improve the development and implementation of major public  health IT initiatives, we recommend that the Secretary of Health and  Human Services take the following two actions:  ensure that the federal initiatives are (1) aligned with the national health  IT strategy, the federal health architecture, and ongoing public health IT  initiatives and (2) coordinated with state and local public health  initiatives and  ensure federal actions to encourage the development, adoption, and  implementation of health care data and communication standards  across the health care industry to address interoperability challenges  associated with the exchange of public health information.
We also recommend that the Secretary of Homeland Security align existing  and planned DHS IT initiatives with other ongoing public health IT  initiatives at HHS, including adoption of data and communications  standards.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Acting  Inspector General at HHS and Director of the Departmental GAO/OIG  Liaison at DHS (these comments are reproduced in app. III and IV). HHS  generally concurred with our recommendations, while DHS did not  comment specifically on the recommendations. Both agencies provided  additional contextual information and technical comments, which we have  incorporated in this report as appropriate. We provided DOD officials with  the opportunity to comment on a draft of this report, which they declined.
Among its comments, HHS officials stated that this report does not  adequately represent the department’s accomplishments in implementing  standards and specifications for health IT or the benefits of pursuing a  standards-based approach. We concur with HHS on the importance of  standards for health information technology and have been calling for  federal leadership in expediting standards since 1993. Page 61 lists GAO  reports on health IT, several of which address the benefits of standards and  the need for a national health IT strategy. In response to HHS’s comment  that we suggest that early event detection is duplicative or irrelevant at the  federal level, neither we nor the state and local public health officials  suggest that early event detection at the federal level is irrelevant. Rather,  we are reporting the concerns of state and local public health officials  regarding the federal government’s role, which merits further discussion  and more involvement of state and local health officials.
As agreed with your offices, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this letter. At that time, we will send copies of the report to other  congressional committees. We will also send copies to the Secretaries of  Health and Human Services, Homeland Security, Defense, and Energy. In  addition, copies will be sent to the state and local public health agencies  that were included in our review. Copies will also be made available at no  charge on our Web site at www.gao.gov. If you have any questions on  matters discussed in this report, please contact me at 202-512-9286 or by e- mail at pownerd@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made major contributions to this report are listed in  appendix V.
section_title: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to  assess the progress of major federal information technology (IT)  initiatives designed to strengthen the effectiveness of the public health  infrastructure and  describe the key IT challenges facing federal agencies responsible for  improving the public health infrastructure.
To address these objectives, we conducted our work at Health and Human  Services (HHS), Department of Homeland Security (DHS), and Department  of Defense (DOD) offices in Washington, D.C., and the Centers for Disease  Control and Prevention (CDC) in Atlanta. We selected specific IT initiatives  to review from systems we identified in previous work, focusing on major  public health IT initiatives in surveillance and communication systems. We  excluded food safety systems and DOD disease surveillance systems that  did not include civilian populations. We discussed our selection with  federal officials to help ensure that we were addressing the most relevant  major initiatives. To assess the progress of major federal IT initiatives  designed to strengthen the effectiveness of the public health infrastructure,  we analyzed agency documents such as Office of Management and Budget’s  Exhibit 300s, minutes of executive council meetings, and system  development documents, including project plans, functional requirements,  and cost-benefit analyses. We supplemented our evaluation of agency  documents with interviews of federal officials. Through interviews with  these officials and with state and local public health officials, we also  assessed CDC’s and DHS’s interaction and coordination with each other on  their IT initiatives.
Because these federal initiatives affect state and local public health  agencies, we supplemented our analysis of agency documentation by  interviewing officials from six state and six local public health agencies on  progress being achieved by CDC and DHS. We conducted our work at the  San Diego County Health and Human Services Agency; the California  Department of Health Services in Sacramento; the Thurston County Public  Health and Social Services and the Washington State Department of Health  in Olympia; the Austin/Travis County Health and Human Services  Department and the Texas Department of State Health Services in Austin;  the Milwaukee City Health Department; the Wisconsin Department of  Health and Family Services in Madison, Wisconsin; the Boston Public  Health Commission and the Commonwealth of Massachusetts Department  of Public Health in Boston; the New York State Department of Health in  Albany; and the New York City Department of Health and Mental Hygiene.  The states and local public health agencies were selected because they  were actively involved in implementing at least one of CDC’s Public Health  Information Network IT applications. We interviewed them on the impact  of federal IT initiatives on state and local public health operations and  lessons they learned from integrating federal IT initiatives into their local  public health infrastructure. If they had systems similar to the federal  systems in our review, we discussed how their systems compared with the  federal initiatives. We also interviewed representatives of several public  health professional organizations, which CDC considers its partners, such  as the National Association of County and City Health Officials, the  Association of State and Territorial Health Officials, the Council for State  and Territorial Epidemiologists and the Association of Public Health  Laboratories. We also had a discussion with the National Association of  State Chief Information Officers.
To identify key IT challenges facing federal agencies responsible for  improving the public health infrastructure, we analyzed published GAO  reports, agency documents, and other information obtained during  interviews and site visits. We summarized the results of our evaluation and  identified the key challenges that CDC and DHS have consistently  encountered as they implement the IT initiatives included in our review.
Our work was performed from July 2004 through April 2005 in accordance  with generally accepted government auditing standards.
section_title: Federal Agencies and Their Roles in Public Health Preparedness and Response
paragraphs: The Department of Health and Human Services (HHS) has primary  responsibility for coordinating the nation’s response to public health  emergencies, including bioterrorism. HHS divisions responsible for  bioterrorism preparedness and response, and their primary  responsibilities, include the following:  The Office of the Assistant Secretary for Public Health  Emergency Preparedness coordinates the department’s work to  oversee and protect public health, including cooperative agreements  with states and local governments. States and local governments can  apply for funding to upgrade public health infrastructure and health care  systems to better prepare for and respond to bioterrorism and other  public health emergencies. The office maintains a command center  where it can coordinate the response to public health emergencies from  one centralized location. This center is equipped with satellite  teleconferencing capacity, broadband Internet hookups, and analysis  and tracking software.
The Centers for Disease Control and Prevention (CDC) has  primary responsibility for nationwide disease surveillance for specific  biological agents, developing epidemiological and laboratory tools to  enhance disease surveillance, and providing an array of scientific and  financial support for state infectious disease surveillance, prevention,  and control. CDC has an emergency operations center to organize and  manage all of its emergency operations, allowing for immediate  communication with HHS, the Department of Homeland Security,  federal intelligence and emergency response officials, and state and  local public health officials. CDC also provides testing services and  consultation that are not available at the state level; training on  infectious diseases and laboratory topics, such as testing methods and  outbreak investigations; and grants to help states conduct disease  surveillance. In addition, CDC provides state and local health  departments with a wide range of technical, financial, and staff  resources to help maintain or improve their ability to detect and  respond to disease threats.
The Food and Drug Administration is responsible for safeguarding  the food supply, ensuring that new vaccines and drugs are safe and  effective, and conducting research on diagnostic tools and treatment of  disease outbreaks. It is increasing its food safety responsibilities by  improving its laboratory preparedness and food monitoring inspections.
The Agency for Healthcare Research and Quality is responsible for  supporting research designed to improve the outcomes and quality of  health care, reduce its costs, address safety and medical errors, and  broaden access to effective services, including antibioterrorism  research. It has initiated several major projects and activities designed  to assess and enhance linkages between the clinical care delivery  system and the public health infrastructure. Research focuses on  emergency preparedness of hospitals and health care systems for  bioterrorism and other public health events; technologies and methods  to improve the linkages among the personal health care system,  emergency response networks, and public health agencies; and training  and information needed to prepare clinicians to recognize the symptoms  of bioterrorist agents and manage patients appropriately.
The National Institutes of Health is responsible, among other things,  for conducting medical research in its own laboratories and for  supporting the research of nonfederal scientists in universities, medical  schools, hospitals, and research institutions throughout the United  States and abroad. Its National Institute of Allergy and Infectious  Diseases has a program to support research related to organisms that  are likely to be used as biological weapons.
The Health Resources Services Administration is responsible for  improving the nation’s health by ensuring equal access to  comprehensive, culturally competent, quality health care. Its  Bioterrorism Hospital Preparedness program administers cooperative  agreements to state and local governments to support hospitals’ efforts  toward bioterrorism preparedness and response.
The Department of Homeland Security (DHS) is responsible for, among  other things, protecting the United States against terrorist attacks. One  activity undertaken by DHS is coordination of surveillance activities of  federal agencies related to national security.
The Science and Technology Directorate serves as the primary  research and development arm of DHS, using our nation’s scientific and  technological resources to provide federal, state, and local officials with  the technology and capabilities to protect the nation. The focus is on  catastrophic terrorism—threats to the security of our homeland that  could result in large-scale loss of life and major economic impact. The  directorate’s work is designed to counter those threats, both by  improvements to current technological capabilities and development of  new, revolutionary technological capabilities.
The Information Analysis and Infrastructure Protection  Directorate is responsible for helping to deter, prevent, and mitigate  acts of terrorism by assessing vulnerabilities in the context of  continuously changing threats. It strengthens the nation’s protective  posture and disseminates timely and accurate information to federal,  state, local, private, and international partners.
The Emergency Preparedness and Response Directorate is  responsible for the National Incident Management System, which  establishes standardized incident management processes, protocols,  and procedures that all responders—federal, state, local and tribal—will  use to coordinate and conduct response actions.
The Department of Defense, while primarily responsible for the health  and protection of its service members, contributes to global disease  surveillance, training, research, and response to emerging infectious  disease threats.
The Defense Threat Reduction Agency provides technical expertise  and capabilities in combat support, technology development, threat  control and threat reduction, including chemical and biological defense.
The United States Army Medical Research Institute of Infectious  Diseases conducts biological research dealing with militarily relevant  infectious diseases and biological agents. It also provides professional  expertise on issues related to technologies and other tools to support  readiness for a bioterrorist incident.
The Department of Energy is developing new capabilities to counter  chemical and biological threats. It expects the results of its research to be  public and possibly lead to the development of commercial products in the  domestic market.
The Chemical and Biological National Security Program has  conducted research on biological detection, modeling and prediction,  and biological foundations to support efforts in advanced detection,  attribution, and medical countermeasures.
The national research laboratories (e.g., Lawrence Livermore, Los  Alamos, and Sandia) are developing new capabilities for countering  chemical and biological threats, including biological detection,  modeling, and prediction.
The Department of Agriculture (USDA) is responsible for protecting and  improving the health and marketability of animals and animal products in  the United States by preventing, controlling, and eliminating animal  diseases. USDA’s disease surveillance and response activities are intended  to protect U.S. livestock and ensure the safety of international trade. In  addition, USDA is responsible for ensuring that meat, poultry, and certain  processed egg products are safe and properly labeled and packaged. USDA  establishes quality standards and conducts inspections of processing  facilities in order to safeguard certain animal food products against  infectious diseases that pose a risk to humans.
The Agricultural Research Service conducts research to improve  onsite rapid detection of biological agents in animals, plants, and food  and has improved its detection capability for diseases and toxins that  could affect animals and humans.
The Food Safety Inspection Service provides emergency  preparedness for foodborne incidents, including bioterrorism.
The Animal and Plant Health Inspection Service has a role in  responding to biological agents that cause zoonotic diseases (i.e.,  diseases transmitted from animals to humans). It also has veterinary  epidemiologists to trace the source of animal exposures to diseases.
The Environmental Protection Agency (EPA) has responsibilities to  prepare for and respond to emergencies, including those related to  biological materials. EPA can be involved in detection of agents by  environmental monitoring and sampling. It is also responsible for  protecting the nation’s water supply from terrorist attack and for  prevention and control of indoor air pollution.
The Department of Veterans Affairs (VA) manages one of the nation’s  largest health care systems and is the nation’s largest drug purchaser. The  department purchases pharmaceuticals and medical supplies for the  Strategic National Stockpile and the National Medical Response Team  stockpile. The VA Emergency Preparedness Act of 2002 directed VA to  establish at least four medical emergency preparedness centers to (1) carry  out research and develop methods of detection, diagnosis, prevention, and  treatment for biological and other public health and safety threats;  (2) provide education, training, and advice to health care professionals  inside and outside VA; and (3) provide laboratory and other assistance to  local health care authorities in the event of a national emergency.
section_title: Comments from the Department of Health and Human Services
paragraphs: The following are GAO’s comments on the Department of Health and  Human Services letter dated June 3, 2005.
subsections: section_title: GAO Comments
paragraphs: 1. We agree with HHS that the cost benefits of a standards-based  approach to public health systems are potentially considerable.  However, as we have reported before, the Center for Information  Technology Leadership acknowledges that their cost estimates are  based on a number of assumptions and inhibited by limited data that  are neither complete nor precise.  2. We agree with HHS that standards-based systems provide important  benefits. In our May 2003 report, we made several recommendations  regarding the establishment and use of standards that are highlighted in  this report. We also state that to support the compatibility,  interoperability, and security of federal agencies’ many planned and  operational IT systems, the identification and implementation of data,  communications, and security standards for health care delivery and  public health are essential.  3. HHS states that our report does not mention a number of activities  related to the Federal Health Architecture and the Consolidated Health  Informatics initiative. We described the status of workgroup efforts  specific to public health surveillance. In terms of the standards adopted  by the Consolidated Health Informatics initiative, we presented the  relevant standards in our table of industry standards used by the Public  Health Information Network. We disagree with HHS that the paragraph  needs to be revised. While the development of standards and policies is  a key component of progress toward the implementation of a national  health IT strategy, the development of a national strategy and  corresponding federal architecture is equally important. 4. We disagree with HHS that we should delete our discussion of the  concerns of state and local public health officials regarding duplication  of effort across federal agencies. Neither we nor the state and local  public health officials suggest that early event detection at the federal  level is irrelevant. Rather, we are reporting the concerns of state and  local public health officials regarding the federal government’s role,  which merits further discussion and more involvement of state and  local health officials. 5. We have adjusted our report to indicate that fiscal year 2006 costs for  BioSense are unknown. 6. HHS comments that not moving forward with its technology initiatives  presents greater risk than waiting for a completed national health IT  strategy. We are not suggesting that HHS stop its ongoing activities; we  only point out the risks associated with developing and implementing  major IT initiatives without a coordinated strategy in place.
section_title: Comment from the Department of Homeland Security
paragraphs: The following is GAO’s comment on the Department of Homeland  Security’s letter dated June 3, 2005.
subsections: section_title: GAO Comment
paragraphs: 1. We disagree with DHS’s statement that we erroneously categorize its  initiatives as still in the early states. The initiatives that we are referring  to as being in the early stages are the Biological Warning and Incident  Characterization System and the National Biosurveillance Integration  System, which according to DHS officials are considered their two  major IT initiatives. DHS categorized them as being in development.
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, Barbara S. Collier, Neil J. Doherty,  Amanda C. Gill, M. Saad Khan, Gay Hee Lee, Mary Beth McClanahan,  M. Yvonne Sanchez, and Morgan Walts made key contributions to this  report.
section_title: Related GAO Reports on Health Information Technology
paragraphs: Health Information Technology: HHS Is Taking Steps to Develop a  National Strategy. GAO-05-628. Washington, D.C.: May 27, 2005.
Health and Human Services’ Estimate of Health Care Cost Savings  Resulting from the Use of Information Technology. GAO-05-309R.  Washington, D.C.: February 17, 2005.
HHS’s Efforts to Promote Health Information Technology and Legal  Barriers to its Adoption. GAO-04-991R. Washington, D.C.: August 13, 2004.
Health Care: National Strategy Needed to Accelerate the Implementation  of Information Technology. GAO-04-947T. Washington, D.C.: July 14, 2004.
Information Technology: Benefits Realized for Selected Health Care  Functions. GAO-04-224. Washington, D.C.: October 31, 2003.
Bioterrorism: Information Technology Strategy Could Strengthen Federal  Agencies’ Abilities to Respond to Public Health Emergencies. GAO-03-139.  Washington, D.C.: May 30, 2003.
Automated Medical Records: Leadership Needed to Expedite Standards  Development. GAO/IMTEC-93-17. Washington, D.C.: April 30, 1993.