Recognizing the potential value of IT for public and private health systems, the federal government has, for several years, been working to promote the nationwide use of health IT. In April 2004, President Bush called for widespread adoption of interoperable electronic health records within 10 years and issued an executive order that established the position of the National Coordinator for Health IT within HHS. The National Coordinator’s responsibilities include developing, maintaining, and directing the implementation of a strategic plan to guide the nationwide implementation of interoperable health IT in both the public and private sectors. According to the strategic plan, the National Coordinator is to lead efforts to build a national health IT infrastructure that is intended to, among other things, ensure that patients’ individually identifiable health information is secure, protected, and available to the patient to be used for medical and nonmedical purposes, as directed by the patient and as appropriate. In January 2007, we reported on the steps that HHS was taking to ensure the protection of personal health information exchanged within a nationwide network and on the challenges facing health information exchange organizations in protecting electronic personal health information. We reported that although HHS and the Office of the National Coordinator had initiated actions to identify solutions for protecting electronic personal health information, the department was in the early stages of its efforts and had not yet defined an overall privacy approach. As described earlier, we made recommendations regarding the need for an overall privacy approach, which we reiterated in subsequent testimonies in February 2007, June 2007, and February 2008. In our report, we described applicable provisions of HIPAA and other federal laws that are intended to protect the privacy of certain health information, along with the HIPAA Privacy Rule and key principles that are reflected in the rule. Table 1 summarizes these principles. We also described in our report and testimonies challenges associated with protecting electronic health information that are faced by federal and state health information exchange organizations and health care providers. These challenges are summarized in table 2. We reported that HHS had undertaken several initiatives intended to address aspects of key principles and challenges for protecting the privacy of health information. For example, in 2005, the department awarded four health IT contracts that included requirements for developing solutions to comply with federal privacy requirements and identifying techniques and standards for securing health information. Since January 2007, HHS has undertaken various initiatives that are contributing to its development of an overall privacy approach, although more work remains. We recommended that this overall approach include (1) identifying milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, (2) ensuring that key privacy principles in HIPAA are fully addressed, and (3) addressing key challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of our recommendation, and it has taken important steps in addressing the two other parts. Nevertheless, these steps have fallen short of fully implementing our recommendation because they do not include a process for ensuring that all key privacy principles and challenges will be fully and adequately addressed. In the absence of such a process, HHS may not be effectively positioned to ensure that health IT initiatives achieve comprehensive privacy protection within a nationwide health information network. The department and its Office of the National Coordinator have continued taking steps intended to address key privacy principles and challenges through various health IT initiatives. Among other things, these initiatives have resulted in technical requirements, standards, and certification criteria related to the key privacy principles described in table 1. The following are examples of ways that the Office of the National Coordinator’s health IT initiatives relate to privacy principles reflected in HIPAA. As part of its efforts to advance health IT, the American Health Information Community defines “use cases,” which are descriptions of specific business processes and ways that systems should interact with users and with other systems to achieve specific goals. Among other things, several of the use cases include requirements and specifications that address aspects of the access, uses and disclosures, and amendments privacy principles. For example, the “consumer empowerment” use case describes at a high level specific capabilities that align with the access principle. It requires that health IT systems include mechanisms that allow consumers to access their own clinical information, such as lab results and diagnosis codes, from other sources to include in their personal health records. The use case also aligns with the uses and disclosures principle and includes requirements that allow consumers to control access to their personal health record information and specify which information can be accessed by health care providers and organizations within health information networks. Further, the consumer empowerment use case aligns with the amendments privacy principle, emphasizing the need for policies to guide decisions about which data consumers should be able to modify, annotate, or request that organizations change. (Other use cases that are related to these privacy principles are the “personalized healthcare” and “remote monitoring” use cases.) Under HHS’s initiative to implement a nationwide health information network, in January 2007, four test network implementations, or prototypes, demonstrated potential nationwide health information exchange and laid the foundation for the Office of the National Coordinator’s ongoing network trial implementations. Activities within the prototypes and the trial implementations are related to privacy principles, including the security, access, uses and disclosures, and administrative requirements principles. For example, the prototypes produced specific requirements for security mechanisms (such as data access control and encryption) that address aspects of the security principle. Additionally, the ongoing trial implementations are guided by requirements for using personal health data intended to address the access, uses and disclosures, and administrative requirements principles. For example, participants in the trial implementations are to provide the capability for consumers to access information, such as registration and medication history data, from other sources to include in their personal health records, to control access to self-entered data or clinical information held in a personal health record, and to control the types of information that can be released from personal health records for health information exchange. In addition, organizations participating in the network are required to provide system administrators the ability to monitor and audit all access to and use of the data stored in their systems. The Healthcare Information Technology Standards Panel continued work to “harmonize” standards directly related to several key privacy principles, primarily the security principle. In addition, the panel developed technical guidelines that are intended to address other privacy principles, such as the authorization principle and the uses and disclosures principle. For example, the panel’s guidelines specify that systems should be designed to ensure that consumers’ instructions related to authorization and consent are captured, managed, and available to those requesting the health information. The Certification Commission for Healthcare Information Technology, which is developing and evaluating the criteria and process for certifying the functionality, security, and interoperability of electronic health records, took steps that primarily address the security principle. For example, the commission defined specific security criteria for both ambulatory and inpatient electronic health records that require various safeguards to be in place before electronic health record systems are certified. Among other things, these safeguards include ensuring that system administrators can modify the privileges of users so that only those who have a need to access patients’ information are allowed to do so and that the minimum amount of information necessary can be accessed by system users. The State-Level Health Information Exchange Consensus Project, a consortium of public and private-sector stakeholders, is intended to promote consistent organizational policies regarding privacy and health information exchange. The consortium issued a report in February 2007 that addresses, among other principles, the uses and disclosures privacy principle. For example, the report advises health information exchange organizations to maintain information about access to and disclosure of patients’ personal health information and to make that data available to patients. The consortium subsequently issued another report in March 2008 that recommended practices to ensure the appropriate access, use, and control of health information. Additionally, two of HHS’s key advisory groups continued to develop and provide recommendations to the Secretary of HHS for addressing privacy issues and concerns: The Confidentiality, Privacy, and Security Workgroup was formed in 2006 by the American Health Information Community to focus specifically on these issues and has submitted recommendations to the community that address privacy principles. Among these are recommendations related to the notice principle that the workgroup submitted in February and April 2008. These recommendations stated that health information exchange organizations should provide patients, via the Web or another means, information in plain language on how these organizations use and disclose health information, their privacy policies and practices, and how they safeguard patient or consumer information. The work group also submitted recommendations related to the administrative requirements principle, stating that the obligation to provide individual rights and a notice of privacy practices under HIPAA should remain with the health care provider or plan that has an established, independent relationship with a patient, not with the health information exchange. The National Committee on Vital and Health Statistics, established in 1949, advises the Secretary of HHS on issues including the implementation of health IT standards and safeguards for protecting the privacy of personal health information. The committee’s recent recommendations related to HHS’s health IT initiatives addressed, among others, the uses and disclosures principle. For example, in February 2008, the National Committee submitted five recommendations to the Secretary that support an individual’s right to control the disclosure of certain sensitive health information for the purposes of treatment. Although the recommendations from these two advisory groups are still under consideration by the Secretary, according to HHS officials, contracts for the nationwide health information network require participants to consider these recommendations when conducting network trials once they are accepted by the Secretary. The Office of the National Coordinator also took actions intended to address key challenges to protecting exchanges of personal electronic health information. Specifically, state-level initiatives (described below) were formed to bring stakeholders from states together to collaborate, propose solutions, and make recommendations to state and federal policymakers for addressing challenges to protecting the privacy of electronic personal health information within a nationwide health information exchange. Outcomes of these initiatives provided specific state-based solutions and recommendations for federal policy and guidance for addressing key challenges described by our prior work (see table 2). The Health Information Security and Privacy Collaboration is pursuing privacy and security projects directly related to several of the privacy challenges identified in our prior work, including the need to resolve legal and policy issues resulting from varying state laws and organizational-level business practices and policies, and the need to obtain individuals’ consent for the use and disclosure of personal health information. For example, the state teams noted the need for clarification about how to interpret and apply the “minimum necessary” standard, and they recommended that HHS provide additional guidance to clarify this issue. In addition, most of the state teams cited the need for a process to obtain patient permission to use and disclose personal health information, and the teams identified multiple solutions to address differing definitions of patient permission, including the creation of a common or uniform permission form for both paper and electronic environments. The State Alliance for e-Health created an information protection task force that in August 2007 proposed five recommendations that are intended to address the challenge of understanding and resolving legal and policy issues. The recommendations, which the alliance accepted, focused on methods to facilitate greater state-federal interaction related to protecting privacy and developing common solutions for the exchange of electronic health information. Beyond the initiatives previously discussed, in June 2008, the Secretary released a federal health IT strategic plan that includes a privacy and security objective for each of its strategic goals, along with strategies and target dates for achieving the objectives. For example, one of the strategies is to complete the development of a confidentiality, privacy, and security framework by the end of 2008, and another is to address inconsistent statutes or regulations for the exchange of electronic health information by the end of 2011. The strategic plan emphasized the importance of privacy protection for electronic personal health information by acknowledging that the success of a nationwide, interoperable health IT infrastructure in the United States will require a high degree of public confidence and trust. In accordance with this strategy, the Office of the National Coordinator is responsible for developing the confidentiality, privacy, and security framework. The National Coordinator has indicated that this framework, which is to be developed and published by the end of calendar year 2008, is to incorporate the outcomes of the department’s privacy-related initiatives, and that milestones have been developed and responsibility assigned for integrating these outcomes. The National Coordinator has assigned responsibility for these integration efforts and the development of the framework to the Director of the Office of Policy and Research within the Office of the National Coordinator. In this regard, the department has fulfilled the first part of our recommendation. While the various initiatives that HHS has undertaken are contributing to the development and implementation of an overall privacy approach, more work remains. In particular, the department has not defined a process for ensuring that all privacy principles and challenges will be fully and adequately addressed. This process would include, for example, steps for ensuring that all stakeholders’ contributions to defining privacy-related activities are appropriately considered and that individual inputs to the privacy framework will be effectively assessed and prioritized to achieve comprehensive coverage of all key privacy principles and challenges. Such a process is important given the large number and variety of activities being undertaken and the many stakeholders contributing to the health IT initiatives. In particular, the contributing activities involve a wide variety of stakeholders, including federal, state and private-sector entities. Further, certain privacy-related activities are relevant only to specific principles or challenges, and are generally not aimed at comprehensively addressing all privacy principles and challenges. For example, the certification and standards harmonization efforts primarily address the implementation of technical solutions for interoperable health IT and, therefore, are aimed at system-level security measures, such as data encryption and password protections, while the recommendations submitted by HHS’s advisory committees and state-level initiatives are primarily aimed at policy and legal issues. Effectively assessing the contributions of individual activities could play an important role in determining how each activity contributes to the collective goal of ensuring comprehensive privacy protection. Additionally, the outcomes of the various activities may address privacy principles and challenges to varying degrees. For example, while a number of the activities address the uses and disclosures principle, HHS’s advisory committees have made recommendations that the department’s activities more extensively address the notice principle. Consequently, without defined steps for thoroughly assessing the contributions of the activities, some principles and challenges may be addressed extensively, while others may receive inadequate attention, leading to gaps in the coverage of the principles and challenges. In discussing this matter with us, officials in the Office of the National Coordinator pointed to the various health IT initiatives as an approach that it is taking to manage privacy-related activities in a coordinated and integrated manner. For example, the officials stated that the purpose of the American Health Information Community’s use cases is to provide guidance and establish requirements for privacy protections that are intended to be implemented throughout the department’s health IT initiatives (including standards harmonization, electronic health records certification, and the nationwide health information network). Similarly, contracts for the nationwide health information network require participants to adopt approved health IT standards (defined by the Healthcare Information Technology Standards Panel) and, as mentioned earlier, to consider recommendations from the American Health Information Community and the National Committee on Vital and Health Statistics when conducting network trials, once these recommendations are accepted or adopted by the Secretary. While these are important activities for addressing privacy, they do not constitute a defined process for assessing and prioritizing the many privacy-related initiatives and the needs of stakeholders to ensure that privacy issues and challenges will be addressed fully and adequately. Without a process that accomplishes this, HHS faces the risk that privacy protection measures may not be consistently and effectively built into health IT programs, thus jeopardizing patient privacy as well as the public confidence and trust that are essential to the success of a future nationwide health information network. HHS and its Office of the National Coordinator for Health IT intend to address key privacy principles and challenges through integrating the privacy-related outcomes of the department’s health IT initiatives. Although it has established milestones and assigned responsibility for integrating these outcomes and for the development of a confidentiality, privacy, and security framework, the department has not fully implemented our recommendation for an overall privacy approach that is essential to ensuring that privacy principles and challenges are fully and adequately addressed. Unless HHS’s privacy approach includes a defined process for assessing and prioritizing the many privacy-related initiatives, the department may not be able to ensure that key privacy principles and challenges will be fully and adequately addressed. Further, stakeholders may lack the overall policies and guidance needed to assist them in their efforts to ensure that privacy protection measures are consistently built into health IT programs and applications. As a result, the department may miss an opportunity to establish the high degree of public confidence and trust needed to help ensure the success of a nationwide health information network. To ensure that key privacy principles and challenges are fully and adequately addressed, we recommend that the Secretary of Health and Human Services direct the National Coordinator for Health IT to include in the department’s overall privacy approach a process for assessing and prioritizing its many privacy-related initiatives and the needs of stakeholders. HHS’s Assistant Secretary for Legislation provided written comments on a draft of this report. In the comments, the department generally agreed with the information discussed in our report; however, it neither agreed nor disagreed with our recommendation. HHS agreed that more work remains to be done in the department’s efforts to protect the privacy of electronic personal health information and stated that it is actively pursuing a two-phased process for assessing and prioritizing privacy-related initiatives intended to build public trust and confidence in health IT, particularly in electronic health information exchange. According to HHS, the process will include work with stakeholders to ensure that real-world privacy challenges are understood. In addition, the department stated that the process will assess the results and recommendations from the various health IT initiatives and measure progress toward addressing privacy-related milestones established by the health IT strategic plan. As we recommended, effective implementation of such a process could help ensure that the department’s overall privacy approach fully addresses key privacy principles and challenges. HHS also provided technical comments, which we have incorporated into the report as appropriate. The department’s written comments are reproduced in appendix II. We are sending copies of this report to interested congressional committees and to the Secretary of HHS. Copies of this report will be made available at no charge on our Web site at www.gao.gov. If you have any questions on matters discussed in this report, please contact me at (202) 512-6304 or Linda Koontz at (202) 512-6240, or by e-mail at melvinv@gao.gov or koontzl@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other contacts and key contributors to this report are listed in appendix III. Our objective was to provide an update on the department’s efforts to define and implement an overall privacy approach, as we recommended in an earlier report. Specifically, we recommended that the Secretary of Health and Human Services define and implement an overall approach for protecting health information that would (1) identify milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, (2) ensure that key privacy principles in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) are fully addressed, and (3) address key challenges associated with the nationwide exchange of health information. To determine the status of HHS’s efforts to develop an overall privacy approach, we analyzed the department’s federal health IT strategic plan and documents related to its planned confidentiality, privacy, and security framework. We also analyzed plans and documents that described activities of each of the health IT initiatives under the Office of the National Coordinator and identified those intended to (1) develop and implement mechanisms for addressing privacy principles and (2) develop recommendations for overcoming challenges to ensuring the privacy of patients’ information. Specifically, we assessed descriptions of the intended outcomes of the office’s health IT initiatives to determine the extent to which they related to these privacy principles and challenges identified by our prior work. To supplement our data collection and analysis, we conducted interviews with officials from the Office of the National Coordinator to discuss the department’s approaches and future plans for addressing the protection of personal health information within a nationwide health information network. We conducted this performance audit at the Department of Health and Human Services in Washington, D.C., from April 2008 through September 2008, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to those named above, key contributors to this report were John A. de Ferrari, Assistant Director; Teresa F. Tucker, Assistant Director; Barbara Collier; Heather A. Collins; Susan S. Czachor; Amanda C. Gill; Nancy Glover; M. Saad Khan; Thomas E. Murphy; and Sylvia L. Shanks.

Summary: Although advances in information technology (IT) can improve the quality and other aspects of health care, the electronic storage and exchange of personal health information introduces risks to the privacy of that information. In January 2007, GAO reported on the status of efforts by the Department of Health and Human Services (HHS) to ensure the privacy of personal health information exchanged within a nationwide health information network. GAO recommended that HHS define and implement an overall privacy approach for protecting that information. For this report, GAO was asked to provide an update on HHS's efforts to address the January 2007 recommendation. To do so, GAO analyzed relevant HHS documents that described the department's privacy-related health IT activities. Since GAO's January 2007 report on protecting the privacy of electronic personal health information, the department has taken steps to address the recommendation that it develop an overall privacy approach that included (1) identifying milestones and assigning responsibility for integrating the outcomes of its privacy-related initiatives, (2) ensuring that key privacy principles are fully addressed, and (3) addressing key challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of GAO's recommendation, and it has taken important steps in addressing the two other parts. The HHS Office of the National Coordinator for Health IT has continued to develop and implement health IT initiatives related to nationwide health information exchange. These initiatives include activities that are intended to address key privacy principles and challenges. For example: (1) The Healthcare Information Technology Standards Panel defined standards for implementing security features in systems that process personal health information. (2) The Certification Commission for Healthcare Information Technology defined certification criteria that include privacy protections for both outpatient and inpatient electronic health records. (3) Initiatives aimed at the state level have convened stakeholders to identify and propose solutions for addressing challenges faced by health information exchange organizations in protecting the privacy of electronic health information. In addition, the office has identified milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, as recommended. Further, the Secretary released a federal health IT strategic plan in June 2008 that includes privacy and security objectives along with strategies and target dates for achieving them. Nevertheless, while these steps contribute to an overall privacy approach, they have fallen short of fully implementing GAO's recommendation. In particular, HHS's privacy approach does not include a defined process for assessing and prioritizing the many privacy-related initiatives to ensure that key privacy principles and challenges will be fully and adequately addressed. As a result, stakeholders may lack the overall policies and guidance needed to assist them in their efforts to ensure that privacy protection measures are consistently built into health IT programs and applications. Moreover, the department may miss an opportunity to establish the high degree of public confidence and trust needed to help ensure the success of a nationwide health information network.