Electronic Health Records: Nonfederal Efforts to Help Achieve Health Information Interoperability
Released: 2015-09-29T00:00:00

Letter

Background

An EHR is a digital version of a patient’s paper medical record or chart. EHRs ideally make information available instantly and securely to authorized users. An EHR can contain the medical and treatment history of a patient, diagnoses, medications, treatment plans, immunization dates, allergies, radiology images, and laboratory and test results. An EHR can also give a provider access to evidence-based tools for making decisions about a patient’s care and can automate certain workflows. EHR system software is typically purchased by providers (such as physicians, hospitals, and health systems) from vendors that develop the systems. When EHR systems are interoperable, information can be exchanged—sent from one provider to another—and then seamlessly integrated into the receiving provider’s EHR system, allowing the provider to use that health information to inform clinical care.

HHS and others view EHR system interoperability as a necessary step toward transforming health care into a system that can achieve goals of improved quality, efficiency, and patient safety. For example, use of interoperable EHR systems could better enable health care providers to view results from diagnostic procedures conducted by other providers to avoid duplication; evaluate test results and treatment outcomes over time regardless of where the care was provided to better understand a patient’s medical history; share a basic set of patient information with specialists during referrals and receive updated information after the patient’s visit with the specialist to improve care coordination; view complete medication lists to reduce the chance of duplicate therapy, drug interactions, medication abuse, and other adverse drug events; and identify important information, such as allergies or preexisting conditions, for unfamiliar patients during emergency treatment to reduce the risk of adverse events.

Health data standards are technical requirements used to, among other things, facilitate health information exchange and interoperability of systems, including EHR systems. Such standards consist of terminology and technical specifications that, when adopted by multiple entities, facilitate the exchange and interoperability of health information. Health data standards include, for example, standardized language for prescriptions and laboratory testing. Standards define how information is packaged and communicated from one entity to another, setting the language, structure, and data types required for integration between the systems. Standards generally have been developed by nonfederal standard development organizations and are accompanied by implementation guides, which can help ensure that standards are implemented uniformly. Consistent implementation of the standards by the vendors that build and sell EHR systems and by providers who use these systems is necessary for interoperability.

The Medicare and Medicaid EHR Incentive Programs are intended to help increase the adoption and meaningful use of EHRs by providing incentive payments for providers—that is, certain hospitals and health care professionals such as physicians—who participate in Medicare and Medicaid, and later imposing payment adjustments, also referred to as penalties, on those Medicare providers that do not meet meaningful use requirements for a program year. Within HHS, ONC and the Centers for Medicare & Medicaid Services (CMS) develop the programs’ requirements. CMS establishes specific requirements providers must meet to qualify for incentive payments. Some of these requirements include the exchange of health information, which is a component of interoperability. ONC identifies health data standards and technical specifications for EHR systems and certifies EHR systems used by providers in the program to help ensure that providers implement a system that offers a minimum level of technological capability, functionality, and security. In order for an EHR system to be certified, it must adhere to requirements related to health information exchange, among other capabilities.

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 and its implementing regulations, the Privacy Rule, regulate covered providers’ use and disclosure of personal health information. Providers may also be subject to additional state privacy rules, which can be more stringent than HIPAA requirements or standards. For example, states can set requirements around default practices for health information exchange. Specifically, states that require patients to “opt-in” to health information exchange do not allow the sharing of health information unless patients affirmatively consent to share health information. States with “opt-out” policies around health information exchange permit, by default, the automatic sharing of patient health information, and patients must affirmatively express their preference to not have information shared if they do not want it exchanged.

Initiatives Described a Variety of Approaches for Addressing Interoperability and Are Generally Works in Progress Selected Initiatives Vary in a Number of Ways, Including Their Products or Services and Membership

The initiatives we reviewed vary in their efforts to achieve or facilitate interoperability, including (1) the primary products or services they offer (e.g., a network or guidance for implementing standards), (2) the types of electronic systems the initiatives are working to make interoperable, (3) the cost of the initiatives’ products or services, (4) the geographic areas served by the initiatives, (5) the extent to which initiatives facilitate patient access to their health information, (6) the stakeholder groups that are members of the initiatives, and (7) the sources of funding for the initiatives.

Most of the Selected Interoperability Initiatives Are Relatively New and Still Undergoing Development

The majority of the initiatives we selected are works in progress, meaning that they are relatively new and therefore still in the process of developing, or encouraging others to adopt, their products or services. Of the 18 initiatives we selected, 10 began after January 2013. Representatives from 6 of the initiatives said that their primary products or services were available in some areas or available on a limited scale; however, according to the representatives, none of their products or services were widely available or widely used at the time of our review. For example, representatives from the 4 initiatives associated with HIE organizations said that they are actively facilitating interoperability, but this interoperability is confined to a single state or region. The 2 other initiatives have products available, but according to representatives, the initiatives are in the very early stages of deploying those products and anticipate that use of their products will increase by 2016. Representatives from 7 of the initiatives stated that their products or services are currently being developed and would not be available until the end of 2015 or sometime in 2016.

Stakeholders and Initiative Representatives Described Five Key Challenges to EHR Interoperability, Efforts to Address These Challenges, and Other Barriers

Stakeholders and initiative representatives we interviewed described five key challenges to EHR interoperability, and initiative representatives described how they are working to address these challenges using different approaches. Initiative representatives also identified other issues beyond the scope of their initiatives that they say need to be addressed in order to move nationwide EHR interoperability forward.

Stakeholders and Initiative Representatives Described Five Key Challenges to EHR Interoperability

Stakeholders and representatives from the selected EHR initiatives described five key challenges to achieving EHR interoperability: (1) insufficiencies in standards for EHR interoperability, (2) variation in state privacy rules, (3) accurately matching patients’ health records, (4) costs associated with interoperability, and (5) need for governance and trust among entities.

Insufficiencies in Standards for EHR Interoperability

While standards for electronically exchanging information among EHR systems exist, stakeholders and initiative representatives said that these standards are not sufficient for achieving EHR interoperability. This challenge stems from the fact that some standards are not specific enough and, as a result, the systems that implement these standards may not be interoperable. According to some stakeholders, some standards allow EHR systems to use different formats and terminology when exchanging data. However, this resulting variability prevents the receiving system from processing the information and properly integrating it into the patient record; in other words, the systems are not interoperable. Information that is electronically exchanged from one provider to another must adhere to the same standards, and these standards must be implemented uniformly, in order for the information to be interpreted and used in EHRs, thereby enabling interoperability.

Variation in State Privacy Rules

Stakeholders and initiative representatives said that exchanging health information with providers in other states, which is necessary for nationwide EHR interoperability, can be difficult. This challenge exists because of variations in privacy rules from state to state, especially variation in laws pertaining to patient consent for sharing health information. According to a representative from one initiative, providers in opt-in states may be hesitant to exchange health information with providers in opt-out states if the providers lack assurance that the patients have explicitly consented to the exchange.

This challenge may be more pronounced when exchanging certain types of sensitive information, such as mental health information or HIV status, among providers in different states. Some states require additional patient consent when exchanging such information. A representative from one initiative explained that current digital methods for exchange do not provide assurance that sensitive information is protected in accordance with privacy rules. According to this initiative representative, the sensitive information that is subject to more stringent privacy rules could be inadvertently aggregated with other health information and exchanged without the patient’s consent, thereby violating privacy rules. Representatives from one initiative noted that they specifically do not include any mental health information in electronic health information exchange, even with patient consent, because of concerns about inadvertently violating privacy rules.

Accurately Matching Patients’ Health Records

Stakeholders and initiative representatives said that another key challenge to EHR interoperability is accurately matching patients’ health records that are stored in different systems. This challenge exists because many EHR systems use demographic information, such as a patient’s name and date of birth, to match different health records for a given patient held by different providers. As we previously reported, demographic variables do not always yield accurate results because, for example, there could be more than one patient with the same information. In addition, providers may not collect and use the same demographic variables for matching. For example, one initiative representative explained that a recent effort to achieve interoperability with another organization stalled because the other organization relies on a patient’s social security number for patient matching, but the initiative does not collect social security numbers for its patients. In addition, some methods to match records for the same patient across providers can fail because of differences across EHR systems in data formats or because of missing data from or inaccurate data in some health records.

Costs Associated with Interoperability

Stakeholders and initiative representatives said that the costs associated with achieving interoperability can be prohibitive for providers. This challenge exists in part because of the high cost of EHR customization and legal fees associated with interoperability. One stakeholder said that many EHR systems require multiple customized interfaces—which are specially designed connections to other health IT systems—in order to facilitate interoperability with other providers and organizations. The costs associated with these customized interfaces are typically paid by the EHR buyers (i.e., providers). Representatives from some initiatives added that the legal fees associated with establishing EHR interoperability can also be significant. For example, as the next section describes, certain agreements may need to be established as a precondition to interoperability.

Need for Governance and Trust among Entities

Stakeholders and initiative representatives said that it can be challenging to establish the governance and trust among entities that are needed to achieve interoperability. These governance practices can include organizational policies related to privacy, information security, data use, technical standards, and other issues that affect the exchange of information across organizational boundaries. One stakeholder noted that it is important to establish agreements to ensure that entities share information openly with all other participants in a network. However, representatives from one initiative noted that there is some risk that the various agreements developed by different EHR initiatives could result in conflicting organizational policies. For example, the representative explained that participants in one initiative cannot participate in another initiative because the initiatives’ organizational privacy policies do not align.

Each Key Interoperability Challenge Is in the Process of Being Addressed by at Least Some Initiatives

Representatives from all 18 of the initiatives we reviewed said they are working to address these key challenges using different approaches (see table 1).

Fifteen of the 18 initiatives are working to address insufficient standards needed to achieve EHR interoperability. Representatives from 7 of the 15 initiatives told us that they are developing instructions for implementing standards in ways that enhance interoperability. For example, 1 initiative provides precise definitions of how different standards can be implemented to meet specific clinical needs, such as locating information about a patient that is contained in other organizations’ EHR systems. This initiative also provides an opportunity for vendors to test that they have successfully incorporated these instructions into their products. Four of these 7 initiatives are working to develop instructions for implementing existing standards, and 3 are working to develop instructions for implementing a new standard that representatives said will improve systems’ ability to interoperate.

Representatives from 8 of the 15 initiatives told us that they require organizations to adopt common technical requirements as a condition of participation in the initiative. For example, representatives from 1 initiative said that it requires participants to adopt specific implementations of standards that enable functions like sharing health care information between entities. Representatives from 5 of the 8 initiatives told us that they also require participants to test their systems to confirm that the systems are able to interoperate with the systems of other initiative participants. For example, 1 initiative provides an online testing tool that vendors and providers must use to assess and demonstrate interoperability before joining the initiative. In addition to requiring agreement on technical requirements, 2 of the 8 initiatives said that they provide semantic normalization—that is, translation of data between different formats and terminology—in order to accommodate variation between organizations exchanging information and enable interoperability. One initiative representative predicted that there will always be a need for some semantic normalization as part of interoperability because it is unlikely that all organizations will adopt the same standards in exactly the same way.

Representatives from initiatives expressed differing opinions on additional actions that are needed to fully address the challenge of insufficient standards, including the role of the federal government in addressing the issue. Representatives from three initiatives said that there is a need for federal leadership on standards and their implementation. Conversely, representatives from two initiatives said that current federal work on standards duplicates existing private sector efforts, and representatives from a third initiative expressed concern that the government is not flexible enough to account for changing technologies and should therefore leave this issue to the private sector. Representatives from three initiatives we spoke with said that standards should be tested through pilots before they are incorporated into national requirements, and suggested that this testing of standards could be an appropriate role for the federal government.

Variation in State Privacy Rules

Eleven of the 18 initiatives we selected are working to address the challenges encountered because of variation in state privacy rules. Representatives from 6 of these 11 initiatives said that their initiatives are working to improve providers’ ability to obtain and track patient consent and other patient preferences electronically. This is important because some state privacy rules require affirmative patient consent to enable exchange. Three of these 6 initiatives are focused on improving patients’ ability to document their consent to exchange and grant access to their personal health information. For example, 1 initiative is developing a framework that allows patients to document digitally whether they consent to information sharing and to incorporate this documentation in providers’ health IT systems. Another initiative is working to enable patient control of their information through patient-mediated exchange, which allows patients to aggregate their health records into a PHR and electronically grant providers access to these records according to the patient’s preferences. Three other initiatives told us that they are using or plan to develop technology that allows providers to share only portions of a patient’s health record, which would allow providers to ensure that they send only information that they are authorized to share.

Representatives from 5 of the 11 initiatives told us that their initiative incorporated specific privacy policies into agreements signed by participants, including policies governing patient consent and access to their health records. For example, 1 nationwide initiative requires participants to obtain affirmative consent from patients before their information can be exchanged using the initiative’s product.

Representatives from several initiatives identified additional actions that are needed to fully address this challenge. Specifically, six representatives said that education on or federal guidance about the application of privacy laws and liability issues would reduce confusion and increase willingness to exchange information across state lines. Representatives from one initiative noted that the difference between states that require patients to affirmatively consent to sharing some or all of their medical information and states that do not have this requirement is a significant barrier to interoperability, though representatives from another initiative said that this difference is less of an issue if providers are educated in the laws of their state.

Accurately Matching Patients’ Health Records

Thirteen of the 18 initiatives are working to address the challenge of accurately matching patients’ health records. Representatives from 4 of the 13 initiatives said that their initiatives are working to improve the quality of the data or types of information used for matching patients’ health records. For example, 2 initiatives are working to establish standard data formats for health IT systems, which may reduce differences in demographic data for the same patient, thus improving the accuracy of matching. Representatives from 2 other initiatives told us that their initiative is working to create a list of patient attributes (e.g., telephone number and address) that can be combined to establish a patient’s identity with high success and enable providers and others to match patient records as accurately as possible.

Representatives from 7 of the 13 initiatives told us that they require their participants to use a standardized method for patient matching or are working to develop standardized methods. For example, 1 initiative requires that all participants incorporate the same patient-matching method into their EHR systems. Representatives from 2 other initiatives said that their initiative is working to reconcile variations in the data elements and formats used for patient matching by network participants, with the goal of adopting a single shared method among all participants. Representatives from another initiative told us that the initiative is working to develop a tool for matching patients to their records that can be incorporated directly into EHR systems. Notably, 2 of the initiatives that are working on patient-matching methods said that they rely on patients to confirm that the match is accurate at the site-of-care. Representatives from 1 of these initiatives noted that this approach may not be practical in circumstances or settings in which information is required immediately or the patient is unresponsive.

Representatives from 2 of the 13 initiatives said that they are working to enable patient-mediated exchange, which involves allowing patients to aggregate their health information in a PHR. One representative noted that patients are likely to notice if their PHR contains information that is incorrectly matched and to correct the error.

Representatives from five initiatives noted that a national patient identifier, which HHS identifies as currently prohibited under law, is needed to fully address this challenge.

Costs Associated with Interoperability

Sixteen of the 18 initiatives are working to address the challenge of the reported high costs associated with interoperability. Some of these initiatives are working to address this challenge using multiple approaches. Representatives from 10 initiatives that said they are addressing this challenge by reducing the need to customize EHR systems to connect with other systems. For example, representatives from 1 initiative explained that participants must adopt standard features that should reduce the amount of customization needed to connect with other systems. Representatives from 3 initiatives explained that they give participants the opportunity to reduce the cost of interoperability by paying for only one interface to connect with all the entities participating in the initiative, instead of paying for individual connections to each entity. Officials from 3 other initiatives told us that they are focused on creating APIs—programming instructions that allow systems to extract data from other systems that adopt the same API—that they said would nearly eliminate the need to customize systems that adopt the API, or are working to leverage APIs to create applications that can be easily added to EHR systems to exchange and analyze interoperable data.

Representatives from 12 initiatives said that their initiatives’ products are or will be available at no cost or at a reasonable cost to providers or vendors. For example, representatives from 4 initiatives told us that the profiles and specifications they are developing will be available free of charge for vendors and providers to incorporate into EHR systems. Representatives from 6 other initiatives said that they are attempting to keep the cost of participation in the initiative reasonable. For example, representatives from 1 initiative said that they adjust their fees for different provider types to accommodate differences in the providers’ data exchange needs, thus increasing the likelihood that providers can afford to participate.

Representatives from three initiatives explained that they are working to address the cost issue by creating standardized legal agreements to govern information sharing, which can be easily adapted by initiative participants and reduce the need for legal services and the accompanying legal fees.

Need for Governance and Trust among Entities

Eleven of the 18 initiatives are working to establish governance and trust among the entities that seek to exchange interoperable health information. Representatives from 7 of the 11 initiatives are fulfilling the need for governance and trust among entities by establishing standard legal agreements that their participants adopt and use to govern relationships within the initiative. For example, 1 initiative crafted a publically available agreement that includes provisions related to security and authentication policies, as well as a requirement that all participants share patient health information openly with all other participants that are authorized to receive this information. Another initiative has created a committee to evaluate specific ways that the data contained in the network may be used and incorporates these decisions into its agreement. Another initiative deliberately designed its agreement so that participants can also adopt existing national agreements; a representative from this initiative noted that if there was a situation in which their agreement conflicted with another initiative’s requirements, the initiative would work to reconcile the conflicting requirements so its participants could participate in both initiatives whenever possible.

Representatives from 4 of the 11 initiatives told us that they are working to address this challenge by fostering consensus and harmonization of policies and business practices across entities and organizations. For example, 1 initiative facilitates consensus among different stakeholders about methods to enable interoperability for certain uses, and releases the results of these discussions publically for other entities to incorporate into their agreements, policies, and practices.

Initiative Representatives Identified Other Issues That Need to be Addressed to Move Nationwide EHR Interoperability Forward

In addition to the five challenges identified by stakeholders and initiative representatives, representatives identified two other issues that need to be addressed in order to move nationwide interoperability forward.

EHR interoperability would move forward once providers saw a value in their systems becoming interoperable. Six initiative representatives said that improvements to EHR systems—such as enhancements that improve providers’ workflow or clinical decision-making—are needed to increase the extent to which an EHR system, and the information contained within it, is a valuable tool for health care providers. Six initiative representatives noted that reforms that tie payment to quality of care rather than number of services provided will incentivize sharing of information across providers to improve efficiency.

Changes to CMS’s Medicare and Medicaid EHR Incentive Programs would also help move nationwide interoperability forward. While 8 initiative representatives we spoke with told us that the EHR Incentive Programs have increased adoption of EHRs, representatives from 5 initiatives suggested pausing or stopping the programs. Representatives from 10 of the initiatives noted that efforts to meet the programs’ requirements divert resources and attention from other efforts to enable interoperability. For example, some initiative representatives explained that the EHR programs’ criteria require EHR vendors to incorporate messaging capabilities into EHR systems, but this capability generally does not enable interoperability at this time. Representatives from 10 of the initiatives said that the criteria currently used to certify EHR systems under the EHR Incentive Programs are not sufficient for achieving interoperability, and representatives from 3 initiatives suggested amending the criteria to focus on testing systems’ ability to interoperate.

Agency Comments

We provided a draft of this report to HHS for comment. HHS provided technical comments, which we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, the National Coordinator for Health Information Technology, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or at kohnl@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix II.

Appendix I: Selected Nonfederal Initiatives GAO Reviewed

We identified nonfederal organizations that have ongoing initiatives that are working to facilitate electronic health record (EHR) interoperability. The 18 initiatives we selected for our work are listed below.

California Association of Health Information Exchanges (CAHIE)

Center for Medical Interoperability (C4MI)

ConCert by Healthcare Information and Management Systems Society (HIMSS) eHealth Initiative (eHI)

Electronic Healthcare Network Accreditation Commission (EHNAC)

Healthcare Services Platform Consortium (HSPC)

Identity Ecosystem Steering Group (IDESG) Healthcare Committee Integrating the Healthcare Enterprise (IHE) USA

Kansas Health Information Network (KHIN)

National Association for Trusted Exchange (NATE)

Open ID Health Relationship Trust (HEART) Working Group

Statewide Health Information Network of New York (SHIN-NY)

Substitutable Medical Applications and Reusable Technologies (SMART) on Fast Healthcare Interoperability Resources (FHIR)

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Tom Conahan, Assistant Director; A. Elizabeth Dobrenz; Krister Friday; Monica Perez-Nelson; and Andrea E. Richardson made key contributions to this report.