Approaches to electronic health information exchange have expanded in recent years with the increased adoption of EHRs and growth of HIE organizations. For example, some providers can electronically exchange clinical information via interoperable EHR systems. In cases in which providers wish to exchange electronic health information but do not have interoperable systems, HIE organizations can serve as key facilitators of exchange by providing for data connections among stakeholders, including laboratories, public health departments, hospitals, and physicians. Specifically, the use of EHR technology and the use of HIE organizations can allow providers to request and receive information about patients from other providers' records, such as medication lists, laboratory results, or previous diagnoses and hospitalizations. For example, when a provider requests information, the HIE organization may be able to identify the sources of the requested data and initiate the electronic transmission that delivers the data from another provider's EHR in a format that can be accepted and processed by the receiving provider's EHR. Examples of exchange activities that can occur using EHR technology directly between providers or through an HIE organization are shown in figure 1. According to an April 2012 article, exchanging EHR information with other entities can be significantly more difficult for a provider than using EHRs to manage health information within the provider's organization only-- without exchanging the information with others. Appendix I provides information about the extent to which providers are able to electronically exchange health information, as reported by providers and stakeholders we interviewed. HITECH provided funding for various activities, including the Medicare and Medicaid EHR programs. These programs are intended to help increase the meaningful use of EHR technology by providing incentive payments for, and later imposing penalties on, providers--that is, certain hospitals and health care professionals such as physicians--who participate in Medicare or Medicaid. These programs are the largest of the activities, in terms of potential federal expenditures, funded by HITECH. Within HHS, CMS and ONC have developed the programs' requirements. As the programs progress through these stages, Stage 1, which began in 2011, set the basic functionalities EHRs must include, such as capturing data electronically and providing patients with electronic copies of health information. CMS and ONC indicated that Stage 1 allowed providers to test the capability of their EHRs to electronically exchange health information. Stage 2, which began in 2014, added requirements such as increased health information exchange between providers to improve care coordination for patients. For example, Stage 2 will require hospitals and professionals to provide an electronic summary of care document for each transition of care or referral to another provider, whereas in Stage 1 this measure was optional. Stage 3, which is scheduled to go into effect in 2017, will continue to expand on meaningful use to improve health care outcomes and the exchange of health information, according to CMS and ONC. The requirements for this stage have not yet been developed. ONC is responsible for identifying health data standards and technical specifications for EHR technology and establishing and overseeing the certification of EHR technology. As part of the EHR programs, providers must report annually on certain mandatory meaningful use measures and on additional measures that they may choose from a menu of measures. Appendix II describes those Stage 1 and Stage 2 meaningful use measures that CMS and ONC reported as specifically relating to health information exchange. Providers and stakeholders we interviewed cited key challenges to electronic health information exchange; in particular, they cited issues related to insufficient standards, concerns about how privacy rules can vary among states, difficulties in matching patients to their records, and costs associated with electronic health information exchange. CMS and ONC officials noted that they have several ongoing programs and initiatives to help address some aspects of these key challenges, but concerns in these areas continue to exist. Reported insufficiencies in standards for electronic health information exchange. While standards for electronically exchanging information within the EHR programs exist, providers reported that standards may not be sufficient in some areas. Information that is electronically exchanged from one provider to another must adhere to the same standards in order to be interpreted and used in EHRs, thereby permitting interoperability. Several providers stated that they often have difficulty exchanging certain types of health information with other providers that have a different EHR system due to a lack of sufficient standards to support exchange. One area for which providers told us standards were insufficient relates to standards for allergies. Specifically, one provider noted that there are not sufficient standards to define allergic reactions, and another provider explained that some EHR systems classify an allergic reaction as a side effect, while other EHR systems classify the same reaction as an allergy. Such differences can cause confusion when health information is exchanged among providers because providers who receive information may have difficulty locating or using information on allergies if their EHR systems classify the information differently than the EHR systems of the providers who sent the information. Similarly, an article from the Journal of the American Medical Informatics Association stated that the proper terminology for encoding patients' allergies is complex and that some gaps still exist across existing standards. Providers who participated in the EHR programs from fiscal year 2011 through fiscal year 2013 could use certified EHR technology that conformed to the 2011 edition of the standards and certification criteria. All providers that participate in the EHR Programs in fiscal year 2014 must conform to the 2014 edition of the standards and certification criteria. ONC is expected to develop another set of standards and certification criteria that certified EHR technology would be required to conform to beginning in 2016. from one entity to another. HHS expects that providers using the 2014 edition will have greater ability to exchange information. Patient encounters are commonly recorded in free-form text narratives, or as unstructured clinical data. While free-form patient narratives give the provider flexibility to note observations that are not supported by structured data, they are not easily searchable and aggregated and can be more difficult to analyze. that RxNorm and the Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT) should be expanded for nonmedication allergies and allergic reactions. Fifth, several providers and stakeholders commented that the Direct Protocol allows for limited exchange, such as exchanging a secure email message, rather than enabling certain other functionalities, such as the ability to query another EHR system. Reported variation in state privacy rules and lack of clarity about requirements. Some providers noted that exchanging health information with providers in other states can be difficult due to their limited understanding of variations in privacy rules from state to state. Some providers also noted that exchange can be especially difficult in cases when providers are located close to state borders and therefore serve patients from another state. Providers that are covered by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 must adhere to federal privacy rules and can also be subject to state privacy rules. These state rules can be more stringent than HIPAA requirements or standards. HIPAA's Administrative Simplification Provisions required the establishment of, among other things, national privacy standards. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 1936, 2021 (codified at 42 U.S.C. SSSS 1320d-1320d-8). These provisions also expressly provided that such national standards would not preempt state laws that impose requirements, standards, or implementation specifications that are more stringent than those imposed under federal regulation. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 1936, 2021, see 42 U.S.C. SSSS 1320d-2 notes. HIPAA regulates covered entities' (including most health care providers') use and disclosure of personal health information. The Privacy Rule generally permits the use or disclosure of an individual's protected health information without the individual's written authorization for purposes of treatment, payment and health care operations. Under the Privacy Rule, more stringent state laws that are not preempted by federal law include those that prohibit or restrict a use or disclosure in circumstances under which such use or disclosure would be permitted under HIPAA. See 45 C.F.R. 160.202. To address privacy issues related to electronic health information exchange, ONC officials have several ongoing efforts. For example, ONC has issued high-level guidance for providers on how to ensure the privacy and security of health information covering a wide range of topics related to meaningful use and the HIPAA Privacy and Security Rules, among other things. Regarding state privacy laws, this guidance suggests that providers seek information from state agencies, RECs, and professional associations to understand how state laws affect the sharing of patient health information. In addition, ONC began the Data Segmentation for Privacy Initiative to develop and pilot test standards for managing patient consents and data segmentation. As part of this initiative, ONC released an implementation guide for consent management and data segmentation in the summer of 2012, and the agency is currently pilot testing this guide. In addition, ONC's state HIE organization program is currently receiving reports from states on how they are implementing their state's privacy rules. Officials expect to receive the information from states by March 2014. ONC officials are hopeful that these efforts will help address privacy concerns and, as a result, facilitate exchange efforts for providers. Although ONC is working on privacy issues, some providers we spoke with reported that lack of clarity in state privacy laws is one reason that they have experienced difficulty exchanging health information with providers in other states. They found it difficult to ensure they were compliant with state laws when exchanging certain personal health information with providers in another state. For example, some providers in Minnesota and Massachusetts noted that some state laws have stringent requirements related to sharing health information related to mental health, or human immunodeficiency virus or other sexually transmitted infections. In addition, some providers told us that different providers in their state have different interpretations regarding how frequently they must obtain consent from the patient, as required under the state privacy rule, for the exchange of patients' health information. For example, some providers may interpret the state privacy rule to mean that every time a patient's health information is exchanged with another provider they have to obtain consent. Other providers in the same state may interpret the state privacy rule to mean that they have to obtain consent only once. In addition to the privacy challenges identified by providers, stakeholders responding to HHS's March 2013 RFI also identified privacy as a challenge related to health information exchange, and noted that additional training for providers on varying state privacy laws is needed to address this challenge. Stakeholders also suggested that HHS could focus more resources on consent policies and recommended that HHS undertake additional work to facilitate (1) electronically obtaining patient consent for disclosing health information, and (2) communicating that consent along with the related health information. Reported difficulty of accurately matching patients to their health records. Some providers we interviewed reported that they do not have an accurate and efficient way to match patients to their records when exchanging health information. Multiple providers and stakeholders cited situations in which several of their patients are listed with the same name and birth year, and live in the same area. Two of these providers reported that patients can be matched to the wrong set of records, and that providers often need to manually match records, which is time- consuming. Some stakeholders also noted similar problems, including safety concerns from incorrect patient matching. HHS programs or initiatives to address patient matching issues related to health information exchange include both a patient matching project and efforts by two federal advisory committees. According to ONC officials, planning for the Patient Matching Initiative was begun by the State Health Information Exchange Cooperative Agreement Program in July 2013, and the project launched publicly in September 2013. The goals of the initiative are to (1) improve patient matching based on an assessment of current approaches used by selected stakeholders, (2) identify key attributes and algorithms for matching patients to their records, and (3) define processes or best practices to support the identified key attributes. The first phase of the initiative was completed in February 2014 with the release of a report containing patient matching recommendations for possible inclusion in Stage 3 of the EHR programs The two and the 2015 edition of the standards and certification criteria.federal advisory committees established under HITECH, the HIT Policy Committee and the HIT Standards Committee, made recommendations to HHS in 2011 that relate to patient matching.recommended standardized formats for demographic data fields, internally evaluating matching accuracy, accountability, developing, promoting and disseminating best practices, and supporting the role of the patient. The HIT Standards Committee made four recommendations on patient matching covering patient attributes that could be used, data quality issues, formats for data elements, and the data that could be returned from a match request. According to ONC officials, as of July 2013 ONC had efforts under way to respond to these recommendations, under the Patient Matching Initiative, in coordination with the committees. For example, to address one recommendation related to developing, promoting, and disseminating best practices, ONC officials said that they plan to determine which approaches to patient matching work best and develop guidance to help organizations implement such steps. Although HHS has ongoing efforts to address the patient matching challenge, several providers and stakeholders commented that more work needs to be done on this issue. Some providers we interviewed use different methodologies, such as algorithms that make use of multiple patient attributes for identifying patients. However, providers told us that they still have challenges matching patients to their records. Several providers and stakeholders have stated that there should be a national patient identifier for matching patients to their records.stakeholders who responded to HHS's March 2013 RFI stated that HHS has an opportunity to reduce the potential risks of engaging in exchange by focusing more resources on patient matching. Some Reported challenges with cost of exchanging health information. Providers we interviewed reported challenges covering costs associated with health information exchange, including upfront costs associated with purchasing and implementing EHR systems, fees for participation in state or local HIE organizations, and per-transaction fees for exchanging health information charged by some vendors or HIE organizations. Several providers said that they must invest in additional capabilities such as establishing interfaces for exchange with laboratories or other entities such as HIE organizations. For example, many providers told us that the cost of developing, implementing, and maintaining interfaces with others to exchange health information is a significant barrier. One provider and several officials estimated various amounts between $50,000 and $80,000 that providers spend to establish data exchange interfaces. Other stakeholders we interviewed or who responded to HHS's March 2013 RFI also identified costs associated with participation in HIE organizations and maintaining EHR systems as a challenge for providers. To address costs of exchanging health information, ONC's State Health Information Exchange Cooperative Agreement Program has provided funding to HIE organizations. Agency officials stated that by funding HIE organizations, a relatively low cost option can be made available for providers to use to exchange health information. However, ONC officials said that this program is scheduled to end in March 2014. In addition, several providers we interviewed told us that for them the benefits to them of joining an HIE organization often do not exceed the costs, in some cases because few providers have joined their state or regional HIE organizations, resulting in limited opportunities to exchange health information. Some providers told us they do not participate in HIE organizations because they exchange information in other ways that they believe are more efficient, such as exchanging directly with other providers that use the same EHR system from the same vendor. One study noted that most health care providers, including over 65 percent of hospitals and 90 percent of physician practices, were not participating in HIE organizations. HHS payments to providers under the EHR programs can help support the cost of exchange, but providers can participate in the programs without routinely exchanging information electronically that could lead to improved care. While some of the meaningful use requirements for Stage 1 and Stage 2 help to facilitate the exchange of health information, they require exchange only under certain circumstances. (See app. II for more information.) For example, one part of the requirement to provide a summary care document for each transition of care or referral in Stage 2 compels providers to complete either (1) one successful electronic exchange of a summary of care record with a recipient using technology designed by an EHR developer other than the sender's, or (2) one successful test with CMS's test EHR during the reporting period. stakeholder we spoke with explained that for this part of the requirement some providers just complete one successful test with CMS's test EHR and do not routinely demonstrate exchanging health information electronically with other EHR systems. HHS officials stated that Stage 2 is an incremental step toward advancing exchange, and that providers generally do not yet have the technology to enable greater exchange. The requirement to provide a summary of care document for each transition of care or referral in Stage 2 also requires eligible professionals and hospitals to provide summary of care documents for more than 10 percent of transitions of care and referrals either (1) electronically transmitted using certified EHR technology or (2) through an exchange with an organization that is a Nationwide Health Information Network Exchange participant or in a way that is consistent with the Nationwide Health Information Network. The Nationwide Health Information Network was a program funded by ONC that transitioned to the eHealth Exchange, a group of federal agencies and nonfederal organizations whose mission, among other things, is to improve public health reporting through secure, trusted, and interoperable health information exchange. CMS and ONC have identified a minimum set of technical capabilities that are required for an EHR to be considered a test EHR. Eligible professionals and hospitals that select to attest to this requirement will be randomly matched with a designated test EHR that is designed by an EHR developer other than the sender's. HHS, including CMS and ONC, developed and issued a strategy document in August 2013 that describes how it expects to advance electronic health information exchange, with principles to guide future actions in three broad areas--accelerating health information exchange, advancing standards and interoperability, and patient engagement. Examples of principles in the strategy include (1) working with multiple stakeholders to develop standards and facilitating the adoption and use of standards among federal agencies; (2) supporting the privacy, security, and integrity of patient health information across health information exchange activities; (3) seeking to enable a patient's health information to be available wherever the patient accesses care, to support patient- centered care delivery; and (4) supporting exchange through state-led efforts to reduce costs to providers. (See app. III for a complete list of principles.) According to the strategy, these principles have the potential to address the key health information challenges identified by providers and stakeholders we interviewed, which relate to standards, patients' privacy, matching patients with data, and costs. GAO-04-408T. See Pub L. No. 103-62, 107 Stat. 285 (1993) (GPRA), as amended by Pub. L. No. 111- 352, 124 Stat. 3866 (2011) (GPRAMA). GPRA requires, among other things, that federal agencies develop strategic plans that include agencywide goals and strategies for achieving those goals. We have reported that these requirements also can serve as leading practices for planning at lower levels within federal agencies, such as individual programs or initiatives. programs and to determine whether adjustments need to be made in order to maintain progress within given time frames. Below are examples of how the lack of these elements affects the HHS strategy. Specific Actions. While the strategy mentions that HHS seeks to enable a patient's health information to be available wherever the patient accesses care, it does not indicate specific actions that HHS will take to implement that principle or how those actions would overcome exchange-related challenges. Including specific actions could enhance the strategy's usefulness for helping to make program management decisions. Prioritized Actions. While the HHS strategy states that HHS will continue to evaluate short- and long-term steps to advance exchange, it does not clearly delineate how future actions related to the principles should be prioritized. Prioritizing actions can help HHS ensure that the most appropriate activities are completed first, to more efficiently achieve the goal of advancing exchange. Milestones. The HHS strategy does not provide milestones with specific time frames to help the agencies gauge their progress in advancing exchange. Exchange-related milestones with specified time frames could be particularly useful because they could provide a framework for determining whether any actions HHS intends to take could help lead to progress in addressing the challenges providers face related to exchange. Milestones with time frames could also set realistic expectations so stakeholders can anticipate when they can expect to see actions to advance exchange. CMS and ONC officials acknowledged the importance of providers being able to exchange health information effectively by Stage 3 of the EHR programs to allow for improved outcomes such as quality, efficiency, and patient safety. Determining specific, prioritized actions and exchange- related milestones with specified time frames can help to ensure that the agencies' principles and future actions result in timely improvements in addressing the key exchange-related challenges reported by providers and stakeholders, which are particularly important because planning for Stage 3 is expected to begin as soon as 2014. This information could also help HHS prioritize its future actions based on whether health information is being exchanged effectively among providers, in order to better achieve the EHR programs' ultimate goals of improving quality, efficiency, and patient safety. HHS and providers have made some progress toward addressing challenges reported by providers and others related to the electronic exchange of health information, but these challenges are complex and difficult to address and are likely to continue to persist. Some of HHS's most important efforts, such as designing the 2014 edition of the standards and certification criteria to include an increased exchange capability in EHR systems, may lead to greater exchange over the next year. In addition, exchange may increase as providers modify their systems to meet more stringent exchange-related requirements in Stage 2 of the EHR programs. However, a number of remaining challenges make these outcomes uncertain. HHS has both ongoing programs and future plans to address concerns about exchange, but it is not always clear how HHS will effectively prioritize and implement its potential responses to the challenges of exchange. Specifically, the HHS strategy to advance electronic health information exchange does not identify specific actions that CMS and ONC expect will lead to increased exchange, prioritize these actions, or include milestones for gauging progress over time. Guidance on planning and implementing effective strategies highlights the importance of key elements, such as specific, prioritized actions and milestones for gauging progress. These elements could help the agencies make future adjustments based on the effectiveness of their efforts. Exchange is especially important because of its potential to help improve coordination of care within the fragmented health care system. According to CMS and ONC officials, ensuring progress in providers' ability to electronically exchange information is critical for the effective implementation of the EHR programs. Without a sufficient focus on exchange--including specific, prioritized actions with milestones and time frames--CMS and ONC run the risk that the desired outcomes of the EHR programs of improved quality, efficiency, and patient safety will be compromised. To address challenges that affect the ability of providers to electronically exchange health information, we recommend that the Secretary of Health and Human Services direct CMS and ONC to take the following two actions: develop and prioritize specific actions that HHS will take consistent with the principles in HHS's strategy to advance health information exchange; and develop milestones with time frames for the actions to better gauge progress toward advancing exchange, with appropriate adjustments over time. We provided a draft of this report to HHS for comment. HHS provided written comments, which are reprinted in appendix IV. HHS concurred with our recommendations. For the first recommendation, HHS (including CMS and ONC) stated that it has begun to develop and prioritize specific action items, consistent with the principles in its strategy to advance health information exchange, and that it has begun to take action on some of the prioritized items. For the second recommendation, HHS (including CMS and ONC) stated that it has begun developing milestones with time frames for the actions to better gauge progress toward advancing exchange. In general, HHS's comments also reiterated that the electronic exchange of health information is a key element of meaningful use and ultimately will be critical for the success of health care delivery system reforms under the Patient Protection and Affordable Care Act. HHS also stated that it has begun to take definitive steps to accelerate exchange through policy guidance, grant funding to states, and development of standards and certification, such as collaborating with private sector organizations that develop health IT standards to fill key gaps in standards to better support information exchange during transitions in care and when coordinating care across providers. Additionally, HHS provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Health and Human Services, the Administrator of CMS, the National Coordinator for Health Information Technology, and other interested parties. In addition, the report will be available at no charge on GAO's website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or at kohnl@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix V. This appendix provides additional information reported from providers we spoke with about health information exchange and its related benefits. We conducted a total of 25 interviews with providers and stakeholders, such as regional extension centers (REC) and health information exchange organizations (HIE organization), in four states--Georgia, Massachusetts, Minnesota, and North Carolina. We interviewed staff from at least two hospitals or health systems and at least one physician office or group practice in each state. We selected the four states because they were mentioned during interviews with officials from HHS and relevant stakeholders as having ongoing efforts related to health information exchange. We asked interviewees about what types of patient health information providers are currently able to electronically exchange, the methods used to exchange such information, and the benefits providers have realized or foresee from such exchange. Providers we interviewed reported that the most critical types of health information that they need to be able to electronically exchange include patient allergy information, medication lists, and problem lists. However, providers generally reported being able to electronically exchange only specific types of health information at this time, including lab orders and results, immunization and prescription information, and certain clinical documents. For example, Almost all the providers we interviewed reported some exchange of lab information. In most cases, such exchanges involved both the submission of lab orders and the receipt of lab results via interfaces designed for exchange between providers and labs or through their electronic health record (EHR) system. While these exchanges were reported to generally occur between providers and laboratories outside their organizations, two providers noted that such capabilities were still limited to sharing lab information with others in the same health system. Some providers also reported electronically exchanging some information with state public health departments, generally immunization data and notification of certain infectious diseases. They said that these electronic exchanges were generally limited to submissions to the departments and did not include receipt of data from these departments. Several of the providers we interviewed said they engaged in e- prescribing activities, which in some instances included both the submission of electronic prescriptions to pharmacies and the receipt of medication information from pharmacies. However, some providers noted that such exchanges could take place only if the pharmacy had a compatible e-prescribing system that could electronically receive prescription information from the provider's EHR system. In the absence of compatible systems, faxes were used. Several providers we interviewed also noted that they could exchange continuity of care documents (CCD) with other providers in their organization, although the exchange of this type of information varied among the providers we interviewed. Several providers said they could exchange CCDs within their health system, whereas other providers said they could exchange this information only with providers using the same EHR vendor. Providers in all four states and stakeholders that we interviewed reported that, at this time, methods used to electronically exchange health information are limited to use within health systems, use between certain EHR systems, or use of the Direct Protocol. For example, In Georgia, REC officials and the four providers we spoke with told us that electronic exchange is generally occurring only within health systems and among those affiliated providers that work in the health systems. Some providers noted that they could electronically exchange lab orders and results outside their organizations, but one provider noted that even this information was still exchanged electronically only within its hospital. Providers in Minnesota, Massachusetts, and North Carolina reported that they used the same EHR system from the same vendor and were able to electronically exchange all patient clinical information with any other entity using that vendor via an interoperability feature. According to these providers, this interoperability feature provides a mechanism for them to electronically exchange all types of clinical information about their patients. A community-based hospital in Minnesota reported using a different EHR system than was used by the other, larger health systems in the community it shared information with. This provider reported relying on the Direct Protocol to electronically exchange some limited health information with other providers in the region. A provider in Massachusetts noted that it was building web-based "view portals" to allow other providers outside its health system to view health information electronically in order to help coordinate patient care. Providers that participated in an HIE organization reported being able to electronically exchange health information with other providers. Others have opted to electronically exchange information using their EHR technology rather than an HIE organization, even if one was available. In Massachusetts, some providers told us that they are able to directly connect to the state's HIE organization in order to electronically exchange health information, such as CCDs. However, not all providers in the state are electronically exchanging information at this time. A Massachusetts law calls for the creation and maintenance of a state HIE organization that allows providers in all health care settings to exchange patient health information with other providers by the end of 2016. Some providers we spoke with in Minnesota said they had no plans to join any of the HIE organizations available in the state at this time due to the limited benefits they would realize from participating, and would instead continue to rely on their EHR technology to electronically exchange health information with other providers that use the same vendor. Some providers noted that without a sufficient number of other providers participating in an HIE organization, it would be of limited value. Several Georgia and North Carolina providers reported that the availability of an HIE organization could help facilitate electronic exchange among providers. Entities in both states are establishing regional HIE organizations that will ultimately connect to one another via a statewide HIE organization. Providers in both states said they expected that the HIE organizations, once established, would facilitate broader electronic exchange of health information throughout the state. Although providers we interviewed described certain circumstances when they could electronically exchange health information, they indicated that they would like to expand the electronic exchange of health information and cited a variety of benefits related to such electronic exchange. For example, some providers noted that electronic exchange can provide access to critical information needed when administering medical care, thus improving care quality and reducing duplicative testing; improve access to information related to a patient's health history, including medication histories and previous diagnoses; result in more timely access to information, which is particularly helpful in emergency departments; and reduce labor-intensive efforts to send and receive health information in paper form, such as a printed document, or conduct public health reporting activities. This appendix provides information on the Stage 1 and Stage 2 meaningful use measures related to electronic health information exchange, according to officials from the Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC). According to these officials, Stage 2, which began in 2014, provides additional requirements related to the exchange of health information. For example, some meaningful use measures related to health information exchange that providers could select from a menu of optional measures in Stage 1 are mandatory for Stage 2. In addition, some Stage 2 measures are new. For example, the measure "provide structured electronic lab results to ambulatory providers" is a new measure for hospitals in Stage 2. See table 1 for more information. This appendix provides information on the principles that the Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC) plan to use to guide their future actions to facilitate health information exchange. These principles are outlined in a strategy that the agencies released in August 2013 to describe how they expect the principles to lead to future actions that have the potential to address the key challenges providers and stakeholders have identified relative to electronic health information exchange in four areas--standards, patients' privacy, matching patients with data, and costs. The strategy includes principles under three broad categories--accelerating health information exchange, advancing standards and interoperability, and patient engagement. See table 2 for more information. In addition to the contact named above, Will Simerl, Assistant Director; La Sherri Bush; Thomas Murphy; Monica Perez-Nelson; Roseanne Price; Andrea Richardson; Teresa Tucker; and Rebecca Rust Williamson made key contributions to this report.

Summary:
The Health Information Technology for Economic and Clinical Health Act (HITECH) promotes the use of health information technology and identifies the importance of health information exchange. It provides incentive payments to promote the widespread adoption and meaningful use of EHR technology. To be a meaningful user, providers are to demonstrate, among other things, that their certified EHR technology can electronically exchange health information. GAO examined (1) the key challenges to the electronic exchange of health information, if any, that have been reported by providers and stakeholders, and HHS's ongoing efforts to address them, and (2) the extent to which HHS has planned future actions to address those key challenges. GAO reviewed HHS documentation; interviewed HHS officials; and interviewed providers--hospital officials and physicians--and relevant stakeholders about their experiences. Providers and stakeholders GAO interviewed in four states with ongoing electronic health information exchange efforts cited key challenges to exchange, in particular, issues related to insufficient standards, concerns about how privacy rules can vary among states, difficulties in matching patients to their records, and costs associated with exchange. Officials from the Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC)--agencies within the Department of Health and Human Services (HHS)--noted that they have several ongoing programs and initiatives to help address some aspects of these key challenges, but concerns in these areas continue to exist. For example, several providers GAO interviewed said that they have difficulty exchanging certain types of health information due to insufficient health data standards. Although HHS has begun to address insufficiencies in standards through its Medicare and Medicaid Electronic Health Record (EHR) programs, such as through the introduction of new 2014 standards for certified EHR technology, it is unclear whether its efforts will lead to widespread improvements in electronic health information exchange. In addition, providers GAO interviewed reported challenges covering costs associated with electronic exchange, such as upfront costs associated with purchasing and implementing EHR systems. While HHS is working to address this challenge through various efforts, including a program that helps fund health information exchange organizations--organizations that provide support to facilitate the electronic exchange of health information--some providers told GAO they do not participate in these organizations because they see limited opportunities for exchanging information through them. HHS, including CMS and ONC, developed and issued a strategy document in August 2013 that describes how it expects to advance electronic health information exchange. The strategy identifies principles intended to guide future actions to address the key challenges that providers and stakeholders have identified. However, the HHS strategy does not specify any such actions, how any actions should be prioritized, what milestones the actions need to achieve, or when these milestones need to be accomplished. GAO's prior work, consistent with the Government Performance and Results Act Modernization Act of 2010 (GPRAMA), sets forth several key elements of strategies that can guide agencies in planning and implementing an effective government program. As noted in GAO's prior work, elements such as specific actions, priorities, and milestones are desirable for evaluating progress, achieving results in specified time frames, and ensuring effective oversight and accountability. Determining specific actions and exchange-related milestones with specified time frames can help to ensure that the agencies' principles and future actions result in timely improvements in addressing the key challenges reported by providers and stakeholders; this is particularly important because planning for Stage 3 of the EHR programs, which focuses on improving outcomes, is expected to begin as soon as 2014. This information could also help CMS and ONC prioritize their future actions based on whether health information is being exchanged effectively among providers, in order to better achieve the EHR programs' ultimate goals of improving quality, efficiency, and patient safety. GAO recommends that CMS and ONC (1) develop and prioritize specific actions that HHS will take consistent with the principles in HHS's strategy to advance health information exchange, and (2) develop milestones with time frames for the actions to better gauge progress toward advancing exchange, with appropriate adjustments over time. In commenting on the draft report, HHS, including CMS and ONC, concurred with these recommendations.