Prescription Drug Data: HHS Has Issued Health Privacy and Security Regulations but Needs to Improve Guidance and Oversight
Released: 2012-06-22T00:00:00

Letter

Background

According to HHS, widespread use of health information technology could improve the quality of care received by patients and reduce health care costs. One such technology, electronic prescribing, can be used, for example, to electronically transmit a prescription or prescription-related information between a health care provider and a pharmacy or to provide other technological capabilities, such as alerting a provider to a potential interaction between a drug and the patient’s existing medications.

In traditional, or paper-based, prescribing, health care providers that are licensed to issue prescriptions for drugs (e.g., physicians or others licensed by the state) write a prescription, and calling it into or have the patient take that prescription to a dispenser (e.g., pharmacy) to be filled. In contrast, use of an electronic prescribing system consists of a licensed health care provider using a computer or hand-held device to write and transmit a prescription directly to the dispenser. Before doing so, the health care provider can request the beneficiary’s eligibility, formulary, benefits, and medication history. Figure 1 illustrates an example of the flow of information during the electronic prescribing process.

In order to transmit a prescription electronically, multiple entities need to have access to an individual’s identifiable health information in an electronic format. Federal laws and regulations dictate the acceptable use and disclosure activities that can be performed with individually identifiable health information, defined as protected health information (PHI). These activities include treatment, payment, health care operations, and—provided certain conditions are met—public health or research purposes. For example, electronic health information can be held by covered entities that perform treatment functions for directly providing clinical care to a patient through electronic prescribing. These covered entities and business associates, such as medical professionals, pharmacies, health information networks, and pharmacy benefit managers, work together to gather and confirm patients’ electronic health information for prescribing, such as a beneficiary’s eligibility, formulary, benefits, and medication history. To electronically transmit prescription drug data between a health care provider and a pharmacy, an electronic health record can be used to obtain information about the health of an individual or the care provided by a health practitioner.

In both paper-based and electronic prescribing, information is also provided to the individual’s health plan for payment, which would include the identification of the beneficiary, the pharmacy, and the drug cost information. In the case of Medicare beneficiaries’ prescription drug data, the information is provided to CMS for Part D payment calculations. Every time a beneficiary fills a prescription under Medicare Part D, a prescription drug plan sponsor must submit a summary record called prescription drug event data to CMS. The prescription drug event data record contains PHI, such as date of birth, the pharmacy that filled the prescription, and the drug dispensed, that enables CMS to make payments to plans. Appendix II provides a summary of the permitted uses and disclosures of PHI.

Prescription Drug Use Information Can Be Used for Purposes Other than Direct Clinical Care

Under certain circumstances, PHI, including prescription drug use information, can be used for purposes not related to directly providing clinical care to an individual. For example, CMS makes Medicare beneficiaries’ prescription drug event data available for use in research studies. Release of these elements outside of CMS must be in accordance with its policies and data-sharing procedures. For example, in order to obtain access to this information interested parties must send in an application and submit a user agreement. Table 1 provides other examples of using prescription drug use data for purposes other than directly providing clinical care.

Depending on the nature of the use, the prescription drug use information is used and transmitted in identifiable form or in de-identified format, which involves the removal of PHI (e.g., name, date of birth, and Social Security number) that can be used to identify an individual.

Federal Laws Establish Privacy and Security Protections of Individually Identifiable Health Information Including Prescription Drug Use Information Used for Purposes Other than Direct Clinical Care

Key privacy and security protections associated with individually identifiable health information, including prescription drug information used for purposes other than directly providing clinical care, are established in two federal laws, HIPAA and the HITECH Act.

Recognizing that benefits and efficiencies could be gained by the use of information technology in health care, as well as the importance of protecting the privacy of health information, Congress passed HIPAA in 1996. Under HIPAA, the Secretary of HHS is authorized to promulgate regulations that establish standards to protect the privacy of certain health information and is also required to establish security standards that require covered entities that maintain or transmit health information to maintain reasonable and appropriate safeguards.

HIPAA’s Administrative Simplification Provisions provided for the establishment of national privacy and security standards, as well as the establishment of civil money and criminal penalties for HIPAA violations. HHS promulgated regulations implementing the act’s provisions through its issuance of the HIPAA rules–the Privacy Rule, the Security Rule, and the Enforcement Rule. The rules cover PHI and require that covered entities only use or disclose the information in a manner permitted by the Privacy Rule, and take certain measures to ensure the confidentiality and integrity of the information and to protect it against reasonably anticipated unauthorized use or disclosure and threats or hazards to its security.

HIPAA provides authority to the Secretary to enforce these standards. The Enforcement Rule provides rules governing HHS’s investigation of compliance by covered entities, both through the investigation of complaints and the conduct of compliance reviews, and also establishes rules governing the process and grounds for establishing the amount of a civil money penalty for a HIPAA violation. The Secretary has delegated administration and enforcement of privacy and security standards to the department’s Office for Civil Rights (OCR).

The HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009 (Recovery Act), is intended to promote the adoption and meaningful use of health information technology to help improve health care delivery and patient care. The act adopts amendments designed to strengthen the privacy and security protections of health information established by HIPAA and also adopts provisions designed to strengthen and expand HIPAA’s enforcement provisions.

Table 2 below provides a brief overview of the HITECH Act’s key provisions for strengthening HIPAA privacy and security protection requirements.

Under the HITECH Act, the Secretary of HHS has significant responsibilities for enhancing existing enforcement efforts, providing public education related to HIPAA protections, and providing for periodic audits to ensure HIPAA compliance.

In implementing the act’s requirements, OCR’s oversight and enforcement efforts are to be documented and reported annually to Congress. These annual reports provide information regarding complaints of alleged HIPAA violations and the measures taken to resolve the complaints. These reports and other related information are required by the HITECH Act to be made publicly available on HHS’s website.

HHS Has a Framework for Protecting Medicare Beneficiaries’ Prescription Drug Use Information but Has Not Issued Required Guidance or Implemented Required Oversight Capabilities

In response to requirements set forth in HIPAA and the HITECH Act, HHS, through OCR, has established a framework for protecting the privacy and security of individually identifiable health information, including Medicare beneficiaries’ prescription drug use information used for purposes other than directly providing clinical care. This framework includes (1) establishing regulatory requirements, (2) issuing guidance and performing outreach efforts, and (3) conducting enforcement activities to ensure compliance with the rules. However, OCR has not issued required guidance to assist entities in de-identifying individually identifiable health information due to—according to officials—competing priorities for resources and internal and external reviews. Furthermore, although it has recently initiated a pilot audit program, the office has not implemented periodic compliance audits as required by the HITECH Act. Until these requirements are fulfilled, OCR will have limited assurance that covered entities and business associates are complying with HIPAA regulations.

HHS Issued Regulations to Implement Key HIPAA and HITECH Act Requirements for Protecting PHI

The Secretary of HHS issued regulations, such as the HIPAA rules, that implement HIPAA requirements and amendments required by the HITECH Act to govern the privacy and security of individually identifiable health information, known as PHI. These rules establish the required protections and acceptable uses and disclosures of individually identifiable health information, including Medicare beneficiaries’ prescription drug use information.

HIPAA provided for the Secretary of HHS to, among other things, (1) issue privacy regulations governing the use and disclosure of PHI and (2) adopt security regulations requiring covered entities to maintain reasonable and appropriate technical, administrative, and physical safeguards to protect the information.

In December 2000, to address the privacy regulation requirement, HHS issued the Privacy Rule. The Privacy Rule regulates covered entities’ use and disclosure of PHI. Under the Privacy Rule, a covered entity may not use or disclose an individual’s PHI without the individual’s written authorization, except in certain circumstances expressly permitted by the Privacy Rule. The Privacy Rule reflects basic privacy principles for ensuring the protection of personal health information, as summarized in table 3.

The Privacy Rule generally requires that a covered entity make reasonable efforts to use, disclose, or request only the minimum necessary PHI to accomplish the intended purpose. Further, the Privacy Rule establishes methods for de-identifying PHI. Under the rule, once identifiers are removed from a data set, it is no longer considered individually identifiable health information and the HIPAA protections no longer apply. De-identification provides a mechanism for reducing the amount of PHI used and disclosed. The Privacy Rule establishes two ways in which PHI can be de-identified. The Safe Harbor Method requires the removal of 18 unique types of identifiers from a data set coupled with no actual knowledge that the remaining data could be used to reidentify an individual, either alone or in combination with other information. The expert determination method requires a qualified statistician or other appropriate expert, using generally accepted statistical and scientific principles, to determine that the risk is very small that an individual could be identified from the information when used alone or in combination with other reasonably available information.

In February 2003, to implement HIPAA security requirements for protecting PHI, HHS issued the HIPAA Security Rule. To ensure that reasonable safeguards are in place to protect electronic PHI, including Medicare beneficiaries’ health information, from unauthorized access or disclosure, the Security Rule specifies a series of administrative, technical, and physical safeguards for covered entities to implement to ensure the confidentiality, integrity, and availability of electronic PHI. Table 4 summarizes these security safeguards.

The Security Rule, which applies only to PHI in electronic form, states that covered entities have the flexibility to use any security measures that allow them to reasonably and appropriately implement specified standards. Specifically, the rule states that in deciding what security measures are appropriate, the covered entity must take into account elements such as its size, complexity, technical infrastructure, cost of security measures, and the probability and criticality of potential risks to its PHI.

The HITECH Act set additional requirements for the Secretary of HHS and expanded and strengthened certain privacy and security requirements mandated under HIPAA and the HIPAA rules. Specifically, to implement provisions of the HITECH Act, the Secretary was required to (1) issue breach notification regulations to require covered entities and business associates under HIPAA to provide notification to affected individuals and the Secretary concerning the unauthorized use and disclosure of unsecured PHI; (2) establish enforcement provisions for imposing an increased tiered structure for civil money penalties for violations of the Privacy and Security Rules; and (3) extend certain Privacy and Security Rule requirements to business associates of covered entities. Such required activities are intended to strengthen protections for PHI, including Medicare beneficiaries’ prescription drug use information.

To implement these provisions of the act, OCR issued two interim final rules—the Breach Notification for Unsecured Protected Health Information Rule, known as the “Breach Notification Rule,” and the HITECH Act Enforcement Rule—and has developed a draft rule intended to, among other things, extend the applicability of certain requirements of the Privacy and Security Rules to business associates. OCR issued the Breach Notification for Unsecured Protected Health Information Rule in August 2009. This rule contains detailed requirements for HIPAA-covered entities and business associates to notify affected individuals and the Secretary following the discovery of a breach of unsecured PHI. In addition, in October 2009, OCR issued the HITECH Enforcement Rule, which amends the HIPAA rules to incorporate HITECH Act provisions establishing categories of violations based on increasing levels of culpability and correspondingly increased tier ranges of civil money penalty amounts.

In addition, in July 2010, OCR issued a notice of proposed rulemaking to modify the HIPAA Privacy, Security, and Enforcement Rules to implement other provisions of the HITECH Act. According to the OCR website, the proposed rule is intended to, among other things, make modifications to extend the applicability of certain Privacy and Security Rule requirements to the business associates of covered entities, strengthen limitations on the use or disclosure of PHI for marketing and fundraising and prohibit the sale of PHI, and expand individuals’ rights to access their information and obtain restrictions on certain disclosures of protected health information to health plans. According to OCR officials, the proposed rule is currently under review by the Office of Management and Budget (OMB), and OCR officials have not determined an estimated time frame for its issuance.

OCR Provides Guidance and Outreach on the Use of PHI, but Has Not Issued Required De-identification Guidance

The HITECH Act also requires HHS to educate members of the public about how their PHI, which may include Medicare beneficiaries’ prescription drug use information, may be used. In addition, the HITECH Act requires HHS to provide guidance for covered entities on implementing HIPAA requirements for de-identifying data—that is, taking steps to ensure the data cannot be linked to a specific individual. Specifically, the act requires HHS to provide information to educate individuals about the potential uses of PHI, the effects of such uses, and the rights of individuals with respect to such uses. In addition—to clarify the de-identification methods established in the HIPAA Privacy Rule—the HITECH Act required OCR to produce guidance by February 2010 on how best to implement the HIPAA Privacy Rule requirements for the de- identification of protected health information.

OCR has undertaken an array of efforts since the rules were issued, as well as to implement the HITECH Act’s requirements to promote awareness of the general uses of PHI and the privacy and security protections afforded to the identifiable information. For example, the office has made various types of information resources publicly available. Through its website, the office provides a central hub of resources related to HIPAA regulations, ranging from guidance to consumers on their rights and protections under the HIPAA rules to compliance guidance to covered entities. More specifically, the office has developed resources to guide covered entities and business associates in implementing the provisions of the Privacy and Security Rules, which include, among other things, examples of business associate contract provisions for sharing PHI, answers to commonly asked questions, summaries of the HIPAA rules, and information on regional privacy officers designated to offer guidance and education assistance to entities and individuals on rights and responsibilities related to the Privacy and Security Rules.

Table 5 below provides a brief overview of OCR’s guidance and education outreach activities in regard to their target audience, purpose, and guidance materials.

In another effort to promote awareness, OCR–—in conjunction with the Office of the National Coordinator for Health Information Technology— established a Privacy and Security Toolkit to provide guidance on privacy and security practices for covered entities that electronically exchange health information in a network environment. The toolkit was developed to implement the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information, also known as the Privacy and Security Framework, and includes tools to facilitate the implementation of these practices to protect PHI. Guidance included with the toolkit includes, among other things, security guidelines to assist small health care practices as they become more reliant on health information technology and facts and template examples for developing notices for informing consumers about a company’s privacy and security policies in a web-based environment.

Although OCR has initiated these efforts to fulfill its responsibilities to promote awareness of allowable uses and provide guidance for complying with required protections under the HITECH Act, it has yet to publish HITECH Act guidance on implementing HIPAA de-identification methods, which was to be issued by February 2010. OCR officials stated that they have developed a draft of the de-identification guidance, but have not set an estimated issuance date. According to the officials, the draft guidance was developed based on the office’s solicitation of best practices and guidelines from multiple venues and forums, including a workshop panel discussion with industry experts in March 2010 that included discussions on best practices and risks associated with de- identifying PHI. The officials stated that guidance will explain and answer questions about de-identification methods as well as clarify guidelines for conducting the expert determination method of de-identification to reduce entities’ reliance on the Safe Harbor method.

The issuance of such implementation guidance could provide covered entities—including those that rely on de-identified prescription drug use information for purposes other than directly providing clinical care—with guidelines and leading practices for properly de-identifying PHI in accordance with Privacy Rule requirements. According to OCR officials, competing priorities for resources and internal reviews have delayed the issuance of the guidance. Officials stated that the draft is currently under government wide review. Although officials stated that the guidance will be issued upon completion of the review, no estimated time frame has been set. Until this guidance is issued, increased risk exists that covered entities are not properly implementing the standards set by the HIPAA Privacy Rule and that identifiers are not properly removed from PHI.

OCR Conducts Enforcement and Oversight Activities but Has Yet to Implement a Sustained Audit Capability

Federal laws authorize HHS to take steps to ensure that covered entities comply with HIPAA privacy and security requirements targeted toward protecting patient data, including Medicare beneficiaries’ prescription drug use information. Specifically, HHS has authority to enforce compliance with the Privacy and Security Rules in response to, among other things, (1) complaints reporting potential privacy and security violations and (2) data breach notifications submitted by covered entities. Furthermore, the HITECH Act increased HHS’s oversight responsibilities by requiring the department to perform periodic audits to ensure covered entities and business associates are complying with the Privacy and Security Rules and breach notification standards.

OCR has developed and implemented an enforcement process that is focused on conducting investigations in response to actions that potentially violate the Privacy and Security Rules. According to OCR officials, the office opens investigations in response to submitted complaints and data breach notifications, as well as conducts compliance reviews based on other reports of potential violations of which the department becomes aware. If necessary, it then requires covered entities to make changes to their privacy and security practices.

OCR receives thousands of complaints and breach notifications each year. Officials stated that these complaints and notifications are reviewed to determine if they are eligible for enforcement and require an OCR investigation. According to information provided by OCR, from 2006 to 2010 the office has received on average about 8,000 Privacy and Security Rule complaints each year. OCR officials reported that as of February 2012, the office conducted investigations of approximately 24,000 complaints alleging compliance violations of the Privacy or Security Rule, resulting in corrective actions by covered entities in 66 percent of the cases. Corrective actions have included training or sanctioning employees, revising policies and procedures, and mitigating any alleged harm. According to OCR’s annual report to Congress on HIPAA Privacy and Security Rule compliance, in instances where an investigation resulted in a determination that a violation of the Privacy or Security Rule occurred, the office first attempted to resolve the case informally by obtaining voluntary compliance through corrective action. Compliance issues investigated most often include impermissible uses and disclosures of PHI and lack of safeguards for or patient access to PHI.

As of May 2012, OCR investigations have resulted in the issuance of a resolution agreement in eight cases. According to OCR officials, a resolution agreement is a formal agreement between OCR and the investigated entity and is used to settle investigations with more serious outcomes. A resolution agreement is a contract signed by HHS and a covered entity in which the covered entity agrees to perform corrective actions (e.g., staff training), submit progress reports to HHS (generally for a period of 3 years), and—in some cases—pay a monetary fine. The eight resolution agreements entered into with the investigated entities all included a payment of a resolution amount, and the development or revision of policies and procedures. In six of these cases further submission of compliance reports or compliance monitoring was required for 2 to 3 years. For example, in response to complaints that several patients’ electronic PHI was viewed without permission by university health system employees, OCR initiated an investigation which revealed that unauthorized employees repeatedly looked at the electronic PHI for numerous patients. The university health system agreed to settle potential violations of the Privacy and Security Rules by committing to a corrective action plan and paying approximately $865,000.

When a covered entity does not cooperate with an OCR investigation or take action to resolve a violation, the office also has the authority to impose a civil money penalty. OCR can levy civil money penalties for failure to comply with the requirements of the Privacy Rule, Security Rule, and Breach Notification Rule. For each violation, the maximum penalty amount in four separate categories is $50,000. For multiple violations of an identical provision in a calendar year, the maximum penalty in each category is $1.5 million. As of May 2012, OCR had issued one civil money penalty for noncompliance in the amount of $4.3 million. Since February 2010, pursuant to the HITECH Act, OCR has received and used the money from settlement amounts and civil money penalties for enforcement of the HIPAA rules.

In June 2011, OCR initiated efforts to conduct pilot audits of 150 covered entities by the end of December 2012. The office contracted for a private firm to identify the population of covered entities from which to select audit candidates. Additionally, the office contracted with a private audit firm to develop the initial audit procedures for covered entities. These procedures—which OCR documentation asserts are to be in accordance with generally accepted government auditing standards—are composed of the requirements from the Privacy, Security and Breach Notification Rules, which include protections afforded to prescription drug use information and uses of it for purposes other than directly providing clinical care. In January 2012, OCR officials stated that the target for audits to complete was revised to 115.

According to OCR documentation, during the pilot each audit is conducted based on the following steps: 1. An audit is initiated with the selected covered entity being informed by OCR of its selection and asked to provide documentation of its privacy, security, and breach notification compliance efforts to the contracted auditors. 2. Contracted auditors use the audit procedures developed to assess the compliance activities of the covered entity. According to officials and documentation provided, these procedures correspond to the requirements of the Privacy, Security, and Breach Notification Rules. In this pilot phase, every audit will include a documentation review and site visit. 3. Contracted auditors will provide the audited covered entity the draft findings within 30 days after conclusion of the field work. 4. Audited entities will have 10 days to provide the audit contractor with comments and outline corrective actions planned or taken. 5. Contracted auditors will develop a final audit report to submit to OCR within 30 days of receipt of the comments. The final report will describe how the audit was conducted, what the findings were, and what actions the covered entity is taking in response to those findings as well as describe any best practices of the entity.

According to OCR officials, an initial set of 20 pilot audits was completed by March 2012. Officials stated that these initial audits resulted in the identification of both privacy and security issues at covered entities, such as potential impermissible uses and disclosures and not appropriately conducting reviews of audit logs and other reports monitoring activity on information systems. OCR officials stated that the remaining 95 pilot audits, 25 of which were initiated in April 2012, will be completed by the end of December 2012.

However, OCR has yet to establish plans for (1) continuing the audit program once the audit pilot finishes in December 2012 and (2) auditing business associates for privacy and security compliance. According to OCR officials, the dedicated Recovery Act funding for the office’s audit effort will expire at the end of December 2012 and officials stated that they have not yet finalized a decision on the future of the program, including the manner in which an audit process will need to be designed to address compliance by business associates. OCR officials stated that the office plans to award a contract in 2012 for a review of the pilot program, including a sample of audits completed during the pilot. OCR officials anticipate that this review will help determine how the office can fully implement an audit function.

Implementing a sustained audit program could allow OCR to help covered entities and business associates identify and mitigate risks and vulnerabilities that may not be identified through OCR’s current reactive processes. Furthermore, inclusion of business associates in such a program is important because, according to OCR data, more than 20 percent of data breaches affecting over 500 individuals that were reported to OCR involved business associates. Without a plan for deploying a sustained audit capability on an ongoing basis, OCR will lack the ability to ensure that covered entities and business associates are complying with HIPAA regulations, including properly de-identifying PHI when data on prescription drug use are used for purposes other than directly providing clinical care.

Conclusions

Through its issuance of regulations, outreach, and enforcement activities, HHS has established a framework for protecting the privacy and security of Medicare beneficiaries’ prescription drug use information when used for purposes other than directly providing clinical care. It has also promoted public awareness on the uses and disclosures of PHI through its education and outreach activities. Further, OCR has established and implemented a process to enforce provisions of the HIPAA Privacy and Security Rules through investigations. However, it has not issued required implementation guidance to assist entities in de-identifying PHI. By not issuing the guidance, increased risk exists that covered entities are not properly implementing the standards set by the HIPAA Privacy Rule and that PHI is not properly stripped of all identifiers that would identify an individual. In addition, OCR has not fully established a capability to proactively monitor covered entities’ compliance through the use of periodic audits as required by the HITECH Act. Specifically, OCR has yet to establish plans for a sustained audit capability upon completion of its pilot program at the end calendar year 2012 and has yet to determine how to include auditing business associates. Without a plan for deploying a sustained audit capability on an ongoing basis, OCR will have limited assurance that covered entities and business associates are complying with HIPAA regulations, including whether Medicare beneficiaries’ prescription drug use information, when used for purposes other than directly providing clinical care, is being appropriately safeguarded from compromise.

Recommendations for Executive Action

To improve the department’s guidance and oversight efforts for ensuring the privacy and security of protected health information, including Medicare beneficiaries’ prescription drug use information, we recommend that the Secretary of HHS direct the Director of the Office for Civil Rights to take the following two actions: Issue guidance on properly implementing the HIPAA Privacy Rule requirements for the de-identification of protected health information.  Establish plans for conducting periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and breach notification standards.

Agency Comments and Our Evaluation

In written comments on a draft of the report, the HHS Assistant Secretary for Legislation agreed with our two recommendations, but provided qualifying comments for both. HHS’s comments are reprinted in appendix III.

Regarding our recommendation that OCR issue guidance on properly implementing the HIPAA Privacy Rule requirements for the de- identification of protected health information, the Assistant Secretary stated that while the department agrees that issuing the guidance will be helpful to covered entities, the department does not agree that without the guidance, covered entities will have limited assurance that they are complying with the HIPAA Privacy Rule de-identification standards. The Assistant Secretary noted that covered entities have been operating under these existing de-identification standards for almost 10 years and that OCR has not found that the standards have been the subject of significant or frequent compliance issues by covered entities. The Assistant Secretary noted that OCR’s purpose in issuing the de- identification guidance was to provide covered entities with the current options and approaches available for de-identifying health information.

We agree that the existing agency information on the de-identification standards provide a level of assurance that covered entities have the parameters and requirements needed to properly remove identifiers from PHI and have clarified this in our report. However, the HITECH Act requires HHS to issue de-identification implementation guidance that addresses how covered entities should implement the de-identification standards. OCR officials stated that the planned guidance will explain and answer questions about de-identification methods as well as clarify guidelines for conducting the expert determination method of de- identification to reduce entities’ reliance on the Safe Harbor method. Such information could assist covered entities in determining how to properly implement the de-identification methods. Until such implementation guidance is issued, increased risk exists that covered entities are not properly adhering to the standards set by the HIPAA Privacy Rule and that PHI is not properly stripped of all identifiers that would identify an individual.

Regarding our recommendation that OCR establish plans for conducting periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and breach notification standards, the Assistant Secretary stated the department did not agree with our report’s conclusion that without such a plan, OCR will lack the ability to ensure that covered entities and business associates are complying with the HIPAA rules. Specifically, he stated that our conclusion did not adequately take into account the considerable impact of the thousands of complaint investigations, compliance reviews, and other enforcement activities OCR conducts annually to ensure covered entities are complying with the rules. He noted that although the audit function is a critical compliance tool for identifying vulnerabilities, the importance of the audit function should not be understood to diminish the effectiveness of OCR’s other enforcement activities for bringing about and enforcing compliance with the HIPAA rules.

As our report highlighted, OCR has developed and implemented an enforcement process that is focused on responding to actions that potentially violate the Privacy and Security Rules. OCR conducts this reactive process through processing complaints and conducting thousands of investigations each year. An audit program is an important addition to OCR’s compliance program as it is a tool to identify vulnerabilities before they cause breaches and other incidents. Without the addition of a proactive process, such as an audit capability, OCR will have limited assurance that covered entities are complying with HIPAA regulations.

HHS also provided technical comments on the report draft, which we addressed in the final report as appropriate.

We will send copies of this report to other interested congressional committees and the Secretary of Health and Human Services. The report will also be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV.

Appendix I: Objective, Scope, and Methodology

Our objective was to determine the extent to which the Department of Health and Human Services (HHS) has established a framework to ensure the privacy and security of Medicare beneficiaries’ protected health information (PHI) when data on prescription drug use are used for purposes other than their direct clinical care.

To address our objective, we identified HHS’s and its Office for Civil Rights’ (OCR) responsibilities for protecting the privacy and security of PHI by reviewing and analyzing the Health Insurance Portability and Accountability Act (HIPAA), including the HIPAA Privacy and Security Rules; the Health Information Technology for Economic and Clinical Health (HITECH) Act; and applicable privacy best practices, such as the Fair Information Practices.

To obtain information on OCR efforts in implementing HIPAA’s and the HITECH Act’s requirements, we reviewed and analyzed documentation related to the office’s public outreach and guidance efforts, enforcement practices, and regulations for covered entity and business associate compliance provided by the office and through the department’s website and compared those documents to the office’s statutory requirements. To obtain information on the office’s enforcement through complaint and breach notice investigations, we interviewed officials, reviewed agency- provided and public information, and analyzed agency documentation. We conducted interviews with OCR officials to discuss the department’s approaches and future plans for addressing the protection and enforcement requirements of the HIPAA Privacy and Security Rules that applied to covered entities and business associates. We also analyzed plans and documentation provided by OCR officials that described enforcement and compliance activities for developing an audit mechanism and compared them with requirements for the audit program established in the HITECH Act.

To describe the uses of prescription drug use data for purposes other than directly providing clinical care, we interviewed representatives from several covered entities, business associates, and medical associations, and reviewed the HIPAA Privacy Rule and academic publications.

We conducted this performance audit at the Department of Health and Human Services in Washington, D.C., from August 2011 through June 2012, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Key Permissible Uses of Protected Health Information

Permissible use Treatment

Description The provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.

The various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care. Certain administrative, financial, legal, and quality improvement activities of a covered entity, as defined in the Privacy Rule, that are necessary to run its business and to support the core functions of treatment and payment.

Example A hospital may use protected health information about an individual to provide health care to the individual and may consult with other health care providers about the individual’s treatment. A hospital may send a patient’s health care instructions to a nursing home to which the patient is transferred. A hospital emergency department may give a patient’s payment information to an ambulance service provider that transported the patient to the hospital in order for the ambulance provider to bill for its service.

With certain exceptions, to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. Marketing includes an arrangement between a covered entity and any other entity, whereby the covered entity discloses PHI to the other entity in exchange for direct or indirect remuneration, for the other entity or its affiliate to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. With limited exceptions, such as for face to face communications, the Privacy Rule requires an individual’s written authorization before a use or disclosure of his or her PHI can be made for marketing. Covered entities may disclose protected health information, without authorization, to public health authorities who are legally authorized to receive such reports for the purpose of preventing or controlling disease, injury, or disability.

Conducting quality assessment and improvement activities, and case management and care coordination. Business management and general administrative activities, including those related to implementing and complying with the Privacy Rule. Needing an individual’s authorization: A health plan sells a list of its members to a company that sells blood glucose monitors, which intends to send the plan’s members brochures on the benefits of purchasing and using the monitors. Not needing an individual’s authorization: An insurance agent sells a health insurance policy in person to a customer and proceeds to also market a casualty and life insurance policy as well.

A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. To use or disclose protected health information without authorization by the research participant, a covered entity must obtain either: (1) institutional review board or privacy board waiver of authorization; (2) representations for a preparatory to research activity; (3) representations that the research is on the protected health information of decedents; or (4) a data use agreement with recipient where only a limited data sets is shared.

The social services department of a local government might have legal authority to receive reports of child abuse or neglect, in which case the Privacy Rule would permit a covered entity to report such cases to that authority without obtaining individual authorization. Approval of a waiver of authorization by an Institutional Review Board or Privacy Board for research, such as for certain records research, when the Board has determined that the use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, and the research could not practicably be conducted without the waiver and without access to the protected health information.

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact above, John de Ferrari, Assistant Director; Nick Marinos, Assistant Director; Sher`rie Bacon; Marisol Cruz; Wilfred Holloway; Lee McCracken; Monica Perez-Nelson; Matthew Snyder; Daniel Swartz; and Jeffrey Woodward made key contributions to this report.