Public health functions in the United States—such as disease detection, vaccinations, and emergency preparedness and response—are conducted by public health officials from 59 state and territorial health departments; approximately 3,000 county, city, and tribal health departments; about 180,000 public and private clinical laboratories; and multiple federal agencies. Since clinicians at the county, city, or tribal level are most likely to be the first ones to detect an incident, they and local public health officials are expected to report an incident or symptoms of diseases to the state health department and other designated parties. States provide supporting personnel, financial resources, laboratory capacity, and other assistance to local responders when needed. When an incident occurs that exceeds or is anticipated to exceed state, local, or tribal resources, state governors may request that the federal government provide resources to assist the state in its response efforts. For incidents involving primarily federal jurisdictions or authorities (e.g., military bases, federal facilities, or federal lands), federal departments and agencies may be the first responders and first line of defense in coordinating activities with state, local, and tribal partners. Along with HHS, several other federal agencies play a role in supporting public health functions, including the Departments of Agriculture, Homeland Security, Defense, and Veterans Affairs. Among these, HHS is the department with primary responsibility for supporting public health emergency preparedness and response: it serves as the federal focal point for coordinating response support for public health and medical services. Figure 1 provides an overview of the public entities having roles and responsibilities in sharing information to support nationwide public health situational awareness. Because of the many participants involved, the identification and management of a public health emergency call for effective communication and collaboration across all levels of government and the public health community. In this regard, efficient information sharing among these entities is essential to create and maintain the situational awareness needed to effectively prepare for, respond to, and manage a public health emergency. Congress recognized the importance of HHS’s role in supporting the nation’s ability to prepare for and respond to public health emergencies and, in 2006, through provisions of PAHPA, established the Office of ASPR. Among other things, the Assistant Secretary of this office serves as the principal advisor to the Secretary of HHS on all matters related to federal public health and medical preparedness and response. This official is also responsible for coordinating with state, local, tribal, and territorial officials to ensure effective integration of federal public health and medical assets during emergencies. The office was established in December 2006 and is made up of six subordinate offices. In addition, PAHPA established the National Biodefense Science Board in 2006, which HHS now refers to as the National Preparedness and Response Science Board. This board is to provide expert advice and guidance to the Secretary on scientific, technical, and other matters regarding current and future chemical, biological, nuclear, and radiological agents. PAHPA also mandated that the Secretary of HHS develop and submit to the appropriate committees of Congress by June 16, 2007, a strategic plan that described the steps the department would take to develop, implement, and evaluate an electronic public health situational awareness network. The network was to be made up of interoperable systems that would enable the simultaneous sharing of information needed to enhance awareness at the federal, state, local, tribal, and territorial levels of public health. The strategy was to identify measurable steps the Secretary would take to develop, implement, and evaluate the network. It was also to identify actions for improving information sharing, coordination, and communication among disparate biosurveillance systems supported by HHS. The law required the department to establish such a network by December 19, 2008. The Secretary designated ASPR to be responsible for developing the public health situational awareness strategy. However, we reported in December 2010 that the Secretary of HHS had not met the requirements enacted by PAHPA in 2006. In particular, we found that the department had not developed a strategic plan for establishing the network and had not integrated relevant but disparate strategies that existed throughout the department as a step toward establishing an electronic public health situational awareness network. Thus, we recommended that the Secretary of HHS develop and implement a strategic plan that defined goals, objectives, and priorities for establishing an electronic public health situational awareness network. We noted that such a plan should include performance measures for evaluating capabilities of existing and planned information systems, identify gaps in information-sharing capabilities and needed areas of improvement, and integrate related strategies within HHS for sharing information among federal, state, local, and tribal entities. The department neither agreed nor disagreed with the recommendation, but stated that a complete strategy would be developed. Subsequently, Congress reauthorized the act in 2013 and reiterated the mandate for HHS to develop a strategy and implementation plan for establishing an electronic public health situational awareness network, and to establish the network. The reauthorization, or PAHPRA, required the Secretary of HHS to submit to the appropriate committees of Congress a coordinated strategy and an accompanying implementation plan no later than 180 days after March 13, 2013—that is, by September 9, 2013. The network was to be established by March 13, 2015. PAHPRA authorized $138,300,000 for each of fiscal years 2014 through 2018 to support HHS’s efforts to implement the network and other activities mandated by the act. In May 2014, ASPR officials completed and the Secretary of HHS submitted the Public Health and Medical Situational Awareness Strategy to Congress. The department submitted the accompanying implementation plan to Congress in September 2015. Figure 2 provides an overview of the submission requirements and delivery time frames of the strategy and plan. Maintaining a situational awareness capability involves an active, continuous, and timely exchange of information that enhances the ability of public health officials to make decisions related to emergency preparedness and response. For about two decades, public health officials at the federal, state, local, tribal, and territorial levels have used IT systems and tools to collect and share information in their day-to-day functions, such as tracking vaccinations and outbreaks of seasonal influenza. Public health officials also use these systems to create the situational awareness needed to enable early detection of, and effective response to, emerging diseases and other public health events. For example, electronic biosurveillance systems are used to collect data such as complaints from emergency department patients and lab test results related to disease syndromes, and to provide these data to public health officials. These data collection and information-sharing techniques are employed not only to detect the initial signs of emerging threats, but also to track the spread of syndromes, diseases, and other biological events throughout the duration of a public health emergency. Additionally, geographic information systems and mapping tools that support emergency response are useful to public health officials, as these tools provide visual and quantitative data such as maps of available hospital facilities and bed capacity, the location of electrical grid generators, and information regarding regional populations. At the federal level, several agencies have implemented and continue to use IT systems and tools as part of their efforts to collect, integrate, and share critical public health and medical information. In our December 2010 report, we described 25 systems in use by HHS’s Centers for Disease Control and Prevention (CDC), Food and Drug Administration (FDA), Indian Health Service, and the Office of ASPR to support public health situational awareness. These systems had been developed and implemented to enable emergency response information-sharing in support of various other public-health-related department initiatives or mandates. In its role as the federal focal point for coordinating response support for public health and medical services, HHS coordinates national emergency response efforts for public health emergencies through ASPR’s Secretary’s Operations Center (SOC). This center was established in 2002 primarily in response to the events of September 11, 2001. The SOC is a 24-hour-a-day, 7-day-a-week emergency operations center that uses information systems and tools to collect and analyze data from other federal emergency operations centers, such as those at CDC and FDA. The systems are also used to share information with other federal agencies that have responsibility for public health and other emergency support functions, such as the Departments of Homeland Security, Agriculture, and Transportation, and with state and local entities. ASPR officials stated that they have used information systems operating from the SOC to support situational awareness during recent emergencies. For example, during the Louisiana flooding in August 2016, HHS deployed regional teams to the field to collect public health data from electronic health records of patients injured or otherwise affected during the flooding. The teams integrated the data into one of the SOC analytical tools, called Fusion Analytics, which layered the patient data with other data, such as information regarding the location of medical facilities that were available and able to treat certain patients. The HHS teams were then able to provide the information to local public health officials to help them make decisions regarding where to transport victims for treatment. In addition, the department used maps and images produced by another system, the HHS emPOWER Map, to identify populations of Medicare beneficiaries who use electricity-dependent medical equipment, such as ventilators and powered wheelchairs. This information was used to support planning and response efforts in the field in case of a power outage. The system also provided graphical information about areas likely to flood in support of emergency responders making preparations. Figure 3 shows an example of the type of information provided by emPOWER Map. ASPR officials noted other ways in which HHS has used IT systems operating from the SOC to help provide situational awareness for the early detection of illnesses in the Zika virus outbreak during the summer of 2016. For example, HHS used its interactive geographical information system tool, called GeoHEALTH, to map the number of cases within the country by state and county. This information was collected from state and local public health officials via CDC’s disease surveillance systems and from the National Biosurveillance Information Center via open source reporting. Using GeoHEALTH, HHS also mapped areas where potential contraceptive access issues could exist based on a number of key factors, including counties with high uninsured rates of women of childbearing age. Another way that GeoHEALTH was used in support of Zika monitoring was to map laboratory capacity for disease testing, as well as areas that were screening for Zika in the blood supply. The maps provided information to public health officials that enabled them to determine, for example, whether a jurisdiction had the medical facilities, lab capacity, resources and medications, and expertise needed to effectively respond to the outbreak. Figure 4 shows an example of a map produced by GeoHealth. ASPR also allows public health entities at the state, local, tribal, and territorial levels to use its systems to collect data. The data are used by these other entities to supplement or enhance information collected from the systems and tools used within their jurisdictions to support biosurveillance, public health reporting, and emergency response operations. Other HHS systems are also available for use by public health entities throughout the country. For example, CDC developed and implemented the BioSense system, which is used not only by its own program and Emergency Operations Center staff, but also by public health staff at state and local health departments and the Department of Veterans Affairs. The system was designed to collect health data from sources such as hospitals, laboratories, and pharmacies, and to provide public health entities access to the data. Such data are needed to create and support situational awareness, and thus improve capabilities for early public health emergency preparedness and response. HHS has defined processes and practices for managing the department’s collection of IT systems and resources under the governance of an established organization. This IT portfolio includes the systems used by the department to support public health situational awareness. Specifically, within HHS, the Office of the Chief Information Officer (CIO) defined processes for managing the IT portfolio when it published the Enterprise Performance Life Cycle Framework in July 2012. The framework was developed to guide the management of department IT resources in a way that facilitates participation with HHS partners. According to the framework, an IT project may be triggered as a result of business process improvement activities, changes in business functions, advances in IT, or it may arise from a law, such as the mandated establishment of electronic network capabilities defined by PAHPA and PAHPRA. The framework defines roles, responsibilities, and activities required to manage IT initiatives, to include those of business owners, critical partners, and integrated project teams. The business owner is the executive in charge of the organization and serves as the primary customer and advocate for an IT project. The business owner is responsible for identifying the business needs and performance measures to be satisfied by an IT project; providing funding for the project; establishing and approving changes to cost, schedule, and performance goals; and validating that the project initially and continually meets business requirements. In the case of a legislatively mandated program, when certain requirements and business needs are largely pre-determined, a business owner and IT project manager still must demonstrate that a proposed project will meet requirements stated in the mandate and do so in the optimal manner. Critical partners for an IT project are functional managers in areas such as enterprise architecture, security, acquisition management, finance, budget, and human resources. The critical partners are considered subject matter experts and participate in project management reviews and governance decisions to ensure compliance with policies in their respective areas. The integrated project team is chaired by an IT project manager with critical partner and business owner representatives to assist with planning and execution of the project. Further, HHS’s Enterprise Performance Life Cycle Framework defines the IT governance organization that will be responsible for ensuring that IT projects are technically sound, follow established project management practices, and meet the business owner’s needs. Components of this governance organization are an Information Technology Investment Review Board, the CIO’s Council/Technical Review Board, and the department’s CIO. In December 2014, FITARA enhanced the level of involvement that department CIOs should assume regarding the decision processes and policies related to IT resources implemented throughout the department, including those within programs such as those for public health emergency preparedness and response. Among other requirements, FITARA states that the CIO of a covered department such as HHS shall be included in the internal planning processes for how the department uses IT resources to achieve its objectives. This includes CIO involvement in planning for IT resources at all points in their life cycle. On June 10, 2015, the Office of Management and Budget (OMB) released a memo that provides federal agencies guidance for enhancing CIO responsibilities and involvement with IT resources in accordance with FITARA. The guidance states that the CIO shall approve the IT components of any plans through a process defined by the department head. The guidance also states that the CIO should establish and maintain a process to regularly engage with program managers to evaluate IT resources supporting each strategic objective. HHS updated its Enterprise Performance Life Cycle Framework IT guidance and governance approach to incorporate the FITARA requirements in October 2016. Although public health entities at the federal, state, and local levels have been using IT systems to support their day-to-day and emergency preparedness and response efforts for about 20 years, they have encountered obstacles in efforts to implement effective and timely electronic sharing of information on a nationwide basis. In addition to the December 2010 report previously discussed, we have issued multiple other reports since 2003 on the need for federal agencies—primarily HHS—to develop strategies and plans for coordinating public health IT initiatives. These include the implementation of IT systems and data- sharing networks among federal, state, and local public health entities. In these reports, we have described challenges related to sharing data among public health entities, including the lack of an overall strategy to guide the establishment of interoperability among related systems. We also have described issues related to benefits versus costs of collecting and integrating public health data at the federal level, and questions regarding the usefulness of such data. Specifically, we described state and local public health officials’ concerns regarding the cost and effort associated with providing data to federal entities to be integrated and shared on a nationwide basis, and whether those integrated data enhanced public health officials’ ability to prepare for and respond to emergencies. In 2003, we evaluated and reported on federal agencies’ efforts to develop IT to support public health emergency preparedness and response. In our report, we identified issues regarding the implementation of health care and public health IT standards and the lack of an overall strategy to guide IT development and initiatives. As a result of the deficiencies we reported, we recommended that the Secretary of HHS, in coordination with other key stakeholders—such as the Secretaries of Defense and Veterans Affairs—establish a national IT strategy for public health preparedness and response. HHS, through activities initiated by the Office of the National Coordinator for Health IT, took steps to implement this recommendation by establishing interoperability standards and addressing privacy concerns as part of its efforts to advance the nationwide implementation of health care IT. In a June 2005 report, we evaluated the progress of federal agencies on their major public health IT initiatives, including one broad initiative at CDC—the Public Health Information Network—that is intended to provide the nation with integrated public health information systems to support activities such as disease detection, tracking, outbreak management, and exchange of laboratory information. We reported that CDC and the Department of Homeland Security faced challenges related to the planning and implementation of IT initiatives, including a need for improvements in systems integration and interoperability, and coordination with state and local public health agencies. Based on the concerns we identified, we recommended that the Secretary of HHS ensure that the federal initiatives were (1) aligned with the national health IT strategy, the federal health architecture, and other ongoing public health IT initiatives and (2) coordinated with state and local public health initiatives. We also recommended that the Secretary ensure that federal actions taken to encourage the development, adoption, and implementation of health care data and communication standards across the health care industry address interoperability challenges associated with the exchange of public health information. The department addressed our recommendations by including public health IT initiatives within its overall strategy for nationwide health IT and by defining other initiatives for improving the exchange of clinical and public health data among public and private health care sectors. In November 2008, we reported on a key HHS syndromic surveillance program—the CDC’s BioSense program. We reported that CDC had not identified annual and long-term cost and timeline estimates and performance measures for implementation of its redesigned BioSense program. We recommended that the Director of CDC develop reliable cost and timeline estimates for implementing the BioSense program and, with stakeholder input, develop outcome-based performance measures. HHS subsequently took steps to implement the recommendations. Specifically, CDC initiated activities to define the estimates and worked with a panel of state and local stakeholders to define performance measures that are focused on the intended results of the program. The Public Health and Medical Situational Awareness Strategy that HHS developed included several objectives and strategies for establishing the network required by PAHPRA. The accompanying implementation plan identified specific actions for accomplishing the objectives. However, the actions identified in the implementation plan did not address all of the requirements defined by the law, including the identification of measurable steps to guide efforts in completing the actions. In the absence of an implementation plan that addressed these critical elements, as of May 2017, HHS had made limited progress toward establishing the required electronic public health situational awareness network capabilities. In addition, HHS did not follow established IT planning and management processes, which has further impeded the department’s ability to make progress toward establishing the network. PAHPRA required HHS to conduct four activities related to the establishment of the public health situational awareness network. Specifically, the law required the department to (1) define minimal data elements for the network; (2) use applicable interoperability standards to facilitate information exchange among public health entities; (3) collaborate with state, local, and tribal public health officials to integrate and build on existing capabilities to ensure simultaneous sharing of data, information, and analyses from the network; and (4) collaborate with state, local, and tribal public health officials to develop procedures and standards for the collection, analysis, and interpretation of data that states, regions, or other entities collect and report to the network. According to PAHPRA, the network was to incorporate data elements from three types of public health information providers: (1) state, local, and tribal health entities; (2) federal health agencies; and (3) zoonotic disease monitoring systems. The law also identified other data to be integrated into the network, if practicable, from other types of providers, including, hospitals, pharmacies, and poison control centers. HHS stated in its Public Health and Medical Situational Awareness Strategy a primary goal for achieving effective public health situational awareness—to protect human health, safety, and well-being by enhancing the nation’s operational capability to support decision making at all government levels and across critical infrastructure sectors before, during, and after an incident. HHS defined five objectives for accomplishing the goal and further described objective-level strategies that were to contribute to accomplishing each of the objectives. The five objectives and objective-level strategies are supported by 49 intended actions that are outlined in the accompanying implementation plan. While not all of these objectives, strategies, and actions are directly related to the development of IT capabilities needed to establish the electronic public health situational awareness network required by PAHPRA, we identified ten specific IT-related actions in the implementation plan that support three objectives and four strategies that are significant to achieving nationwide information-sharing capabilities to meet the law’s requirements. These objectives, strategies, and actions are summarized in table 1. Relative to PAHPRA, six of the 10 IT-related actions in the implementation plan address two of the four activities required by the law. Specifically, actions to improve health information exchanges (3.1.3) and to, where possible, innovate and improve the functional compatibility of health information systems (3.1.4) address the PAHPRA requirement to use interoperability standards. Further, four actions in the implementation plan address the requirement in the law that called for collaborating with public health officials at all levels to integrate and build on existing network capabilities: implement mechanisms for routine inter-disciplinary and interdepartmental health information sharing (2.2.3), comprehensively review and evaluate existing and planned data systems (3.3.1), inventory regional health information organizations and exchanges (3.3.2), and develop the capability to house, share, and appropriately use information related to public health situational awareness (3.3.6). Further, with regard to the sources of data for the network, the IT-related actions discussed in the implementation plan include two that support the collection of data from the three types of providers defined in PAHPRA. Specifically, actions 2.2.2 and 2.2.3 are intended to identify the collection of data from federal and non-federal partners, to include data related to zoonotic diseases. However, the implementation plan does not include actions that would address two other activities required by the law. Specifically, the plan lacks any actions to address a required activity for defining the minimal data elements needed to establish the network, and another activity for collaborating with public health officials to develop standards for interpreting and reporting on data collected by the network. When reporting on barriers to meeting requirements of PAHPRA, HHS described challenges related to the definition of essential data elements and the establishment of standards to enable system interoperability. Accordingly, ASPR officials did not include in the implementation plan any specific actions related to defining the minimal data needed or establishing applicable standards for the network. Table 2 summarizes the required activities and network data providers defined by PAHPRA, and actions included in the implementation plan that address the requirements of the law. Lacking the specific actions to define the minimal data elements needed from the sources and to develop standards for sharing the data in collaboration with state, local, and tribal public health officials, the implementation plan’s usefulness for ensuring that needed information is available to be shared in a standardized format and can be used by public health officials throughout the nation is diminished. Moreover, until HHS addresses all activities required by PAHPRA in its implementation plan, the department will not be able to ensure that public health situational awareness network capabilities will be established in accordance with all the requirements defined by the law. PAHPRA required HHS to identify measurable steps the Secretary would carry out to guide the efforts to develop, implement, and evaluate the network. Further, the law required the National Preparedness and Response Science Board to assist HHS in its planning efforts by providing expert advice and guidance, including recommendations, regarding the measurable steps the Secretary should take to modernize and enhance public health situational awareness information sharing capabilities through a biosurveillance network. To define measurable steps for IT projects, OMB guidance notes that implementation plans should include a timeline of tasks and steps toward implementing requirements; an estimate of costs to implement the tasks; resource requirements; and performance metrics to be used to determine whether tasks are completed on time and within resource requirements, and whether they result in the expected outcomes. However, the implementation plan that HHS developed does not identify timelines, estimates of cost and resource requirements, or performance metrics that can be used to track and measure progress made toward completing tasks and, thus, to determine whether expected progress and outcomes of the IT-related actions are being achieved. For example, actions included in the plan to enhance existing information-sharing networks in support of public health situational awareness are defined to be taken within a broad time frame—between 2016 and 2018—but do not include metrics, such as interim milestones for completing specific tasks, that could be used to monitor and measure progress toward completing the actions. Further, the plan does not identify cost estimates to implement the actions or any performance metrics to determine whether the outcomes of the actions deliver expected benefits on time and within cost, as suggested by OMB guidance. HHS officials also did not identify in the implementation plan specific resource requirements and responsibilities for taking the actions identified in the plan. For example, although the plan identifies HHS and state, local, tribal, and territorial stakeholders as the lead entities for taking a number of the actions, and the Departments of Homeland Security, Defense, and Veterans Affairs as participating entities, it does not designate identifiable contacts, such as particular offices within the departments or stakeholder contacts within the many public health entities identified in the plan. In addition, HHS officials did not include in the implementation plan any measurable steps related to the enhancement of public health situational awareness information sharing capabilities through a biosurveillance network, as required by the law. While the National Preparedness and Response Science Board provided to HHS a number of recommendations related to the integration of biosurveillance systems and information, it did not identify and recommend the specific tasks and the timelines, estimates of cost, and resources requirements necessary to achieve a national biosurveillance system based on existing state, regional, and community level capabilities. Instead, the board recommended that HHS establish a central authority within the department to define the measurable steps for achieving these capabilities. ASPR officials stated that they did not identify measurable steps for completing the actions identified in the implementation plan because they created the National Health Security Strategic Guidance Committee in the summer of 2016 to be responsible for developing the measures and overseeing the conduct of the actions, including those related to biosurveillance. However, the National Health Security Strategic Guidance Committee charter does not include any responsibilities related to defining steps or overseeing the actions for establishing the network, and, as of May 2017, the committee had not done so. Because HHS did not identify measurable steps, in accordance with PAHPRA and OMB guidance, it lacks key planning elements needed to ensure the actions are taken to develop the network. Moreover, until the department defines such steps, it will not have the information and planning tools it needs to make progress toward establishing the network required by PAHPRA. In the absence of an implementation plan that addresses all of the activities required by PAHPRA, the department has made limited progress toward establishing the public health situational awareness network. HHS issued a report in January 2017 that was intended to provide an update on the status of the actions identified in its implementation plan. The report discussed the outcomes from one action that had partially addressed the third objective of the implementation plan—to evaluate existing network capacity to ensure it is leveraged where appropriate and that new capacity is promoted where needed. Specifically, the report described existing capacity within the department that supports information sharing among public health entities. It noted that such capacity is achieved through the use of several systems that ASPR has implemented and operates within the SOC. (Appendix II provides an overview of these systems, as described in HHS’s report.) While ASPR officials stated that these systems provide information sharing capabilities required by PAHPRA, they did not take all the actions that were defined to fully address the third objective of the implementation plan, including actions 3.1.2, 3.1.3, and 3.1.4. Specifically, they did not assess network capacity existing among all levels of public health to gain an understanding of the networks and the contributions each could make to support nationwide public health situational awareness. The officials did not identify where interoperability existed or was needed between systems and networks, or whether integration techniques were needed to ensure that all relevant information from disparate networks could be shared. Further, ASPR officials did not identify and evaluate other federal agencies’ and state, local, and tribal public health entities’ existing electronic information-sharing network capabilities, as required by the law. Although actions for doing so were identified in the plan (actions 3.3.1, 3.3.2, 3.3.5, and 3.3.6), neither ASPR nor any other department officials had identified electronic information-sharing capabilities existing among public health entities that could be built upon to establish the network required by PAHPRA. As a result, outcomes of ASPR’s actions to evaluate existing capacity did not provide the information needed to determine what network capabilities already exist throughout all levels of public health and what system enhancements need to be developed to establish electronic public health situational awareness capabilities in accordance with PAHPRA. HHS’s January 2017 status report also did not address any other IT- related actions identified in the implementation plan for establishing the network. Specifically, the report did not discuss any actions taken to address the first and second objectives of the implementation plan and, therefore, did not reflect the status of HHS’s efforts to create a working group and develop a set of measures for each action to track progress toward developing the network capabilities required by PAHPRA. Likewise, the report does not address the status of any actions taken by the department to engage federal and nonfederal public health officials to ensure the information required to establish the network is available. ASPR officials told us that the development and implementation of the systems operating in the SOC represent the extent of their efforts that could address IT-related actions identified in the implementation plan. They stated that the specific actions outlined in the plan had not been taken because other public health partners within federal agencies and state, local, tribal, and territorial entities were designated in the plan to be responsible for leading and participating in the steps necessary to complete the actions. A director within ASPR further stated that, while they are responsible for establishing policy and making plans to address the PAHPRA mandate, they are not responsible for establishing the electronic network capabilities other than those provided through the operation of the systems in the SOC. However, neither the National Health Security Strategic Guidance Committee nor any other entity within HHS has taken responsibility to ensure that actions are taken to establish the network, and to track and monitor progress of the actions from initiation to completion. Further, according to ASPR officials, as of May 2017, the department had not designated funds to be used for purposes of planning for or establishing the network, and had not accounted for any funds used specifically to develop the strategy and implementation plan. Beyond the deficiencies in its plans for implementing the network, HHS did not follow the department’s overall IT planning and management processes, which contributed to the lack of progress in establishing the network. For example, HHS’s Enterprise Performance Life Cycle Framework defines the CIO’s authority over the department’s collection of IT systems and resources—its IT portfolio—which includes the systems within the SOC and other systems used for situational awareness purposes throughout the department. According to guidance provided by the framework, the CIO should, therefore, play a key role in managing and facilitating the department’s efforts to identify and implement any system improvements needed to enhance electronic public health situational awareness network capabilities to meet the requirements of PAHPRA. The Enterprise Performance Life Cycle Framework also establishes the roles and responsibilities of an integrated project team to manage an IT initiative. The team is to be chaired by an IT project manager. Among other activities, the project manager is responsible for: developing a project management plan to be used as the principal tool for organizing and managing IT projects; ensuring that all appropriate business stakeholders and technical experts are involved throughout the life cycle of an IT project; proactively reporting missed project milestones and variances in percentage of project cost, schedule, and performance; maintaining information on project status, control, performance, risk, corrective actions, and outlook; planning and conducting phase activities and verifying that the set of deliverables for the phase is complete; and conducting formal reviews at specified points in the life cycle of the project. The project manager for a statutorily mandated project, such as the electronic network required by PAHPRA, is to demonstrate that a proposed project will meet requirements stated in the mandate and do so in an optimal manner. The project team is also to include a business owner who is responsible for activities such as: identifying the business needs and performance measures to be satisfied by the project; providing funding for the IT project; establishing and approving changes to cost, schedule, and validating that the project initially meets business requirements and continues to meet business requirements; and conducting a preliminary enterprise architecture review to determine any potential duplication or contradictions with other existing projects. In addition, the department’s IT governance organization, led by the CIO, is to be responsible for ensuring that IT projects are technically sound, follow established project management practices, and meet the business owner’s needs. However, ASPR officials did not follow the department’s established processes when developing the implementation plan for the electronic network required by PAHPRA. Specifically, while ASPR designated the National Health Security Strategic Guidance Committee to be responsible for managing and overseeing the actions related to the establishment of the network, the committee’s authority was not established in accordance with department guidelines for managing IT resources. In particular, the committee does not include a project manager, business owner, or the CIO; rather, it is made up of policy and planning officials from HHS and other federal agencies. As such, HHS has not established the management structure needed to oversee the use of IT resources in any efforts taken to enhance electronic information sharing in accordance with PAHPRA. Further, in developing the department’s public health situational awareness implementation plan, ASPR officials did not take other steps required by departmental guidance for managing IT projects. For example, HHS’s Enterprise Performance Life Cycle Framework guidance calls for an IT project manager to develop a full project management plan to include costs, schedule, and resource requirements for actions to be taken. However, an IT project manager was not designated to take responsibility for defining and implementing any system improvements needed to enhance electronic public health situational awareness network capabilities, and no such plan was developed. Additionally, the framework requires an IT project’s business owner to establish and approve changes to performance metrics and a project manager to report variances and delays in meeting performance milestones. Such actions are needed to track progress made toward project completion and to ensure that expected performance outcomes are achieved. However, as noted previously, no performance metrics for establishing the network have been defined, and HHS did not designate a business owner to be responsible for tracking any progress made toward implementing the network capabilities required by PAHPRA. ASPR officials told us that, because they were tasked by the Secretary to develop the public health situational awareness strategy and implementation plan required by PAHPRA, no department entity having IT management responsibilities was involved. However, had HHS followed its own departmental guidance for managing IT resources—such as establishing an IT resource management structure, developing a project management plan, and defining metrics for tracking performance—the department would have had the planning tools, resources, and oversight mechanisms needed to actively pursue efforts to establish the required network capabilities. Until HHS adheres to departmental guidance for managing the IT resources necessary to identify and implement enhancements needed to improve electronic information-sharing capabilities of systems and networks in use by public health entities throughout the country, its efforts to establish the nationwide public health situational awareness network required by PAHPRA will continue to be hampered. HHS officials developed a public health situational awareness implementation plan that identifies actions to address a number of the requirements for evaluating and establishing network capabilities defined by PAHPRA. However, the usefulness of the implementation plan is diminished because it does not include all activities required by the law or steps that can be measured to determine whether actions have been initiated and completed. In the absence of a complete and useful implementation plan, the department has reported making limited progress toward establishing the network. Further, HHS did not follow established departmental processes for managing IT resources in its planning efforts, which may have contributed to its lack of progress. In particular, department officials did not call for the establishment of an integrated project team, in accordance with CIO guidance, for managing and overseeing the use of IT resources to implement the technical requirements called for by the law. The importance of HHS’s responsibility for supporting emergency preparedness and response at all levels of public health calls for the CIO to play a key role in managing HHS’s efforts to identify and implement any system capabilities needed to enhance electronic public health situational awareness network capabilities. Without leadership of the CIO, the agency will continue to lack the guidance and oversight needed to implement a network that provides the electronic information-sharing capabilities required by PAHPRA. Consequently, HHS will remain unable to provide Congress reasonable assurance that the outcomes of any ongoing and future efforts will result in progress towards accomplishing the goals and objectives for enhanced nationwide public health situational awareness as envisioned by the law. To ensure progress is made toward the implementation of any IT enhancements needed to establish electronic public health situational awareness network capabilities mandated by PAHPRA, we are recommending that the Secretary of HHS direct the Assistant Secretary for Preparedness and Response to take the following three actions: 1. Task an integrated project team, made up of an IT project manager and business owner, with including specific actions in the Public Health and Medical Situational Awareness Strategy Implementation Plan for conducting all activities required to establish and operate the network. 2. Task the integrated project team with developing a project management plan that includes measurable steps—including a timeline of tasks, resource requirements, estimates of costs, and performance metrics—that can be used to guide and monitor HHS’s actions to establish the network defined in the plans. 3. Conduct all IT management and oversight processes related to the establishment of the network in accordance with Enterprise Performance Life Cycle Framework guidance, under the leadership of the HHS CIO. We provided HHS a draft of this report for review and comment. Officials in the department’s Office of the Assistant Secretary for Legislation responded that they had no comments on the report’s findings and recommendations. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objective of our review was to determine what progress the Department of Health and Human Services (HHS) has made towards establishing electronic situational awareness network capabilities in accordance with the requirements of the Pandemic and All-Hazards Preparedness Reauthorization Act of 2013 (PAHPRA). To address the objective, we reviewed section 204 of PAHPRA to identify requirements for an electronic situational awareness network, which includes a strategy for establishing electronic public health situational awareness capabilities, developing a plan for implementing the strategy, and incorporating recommendations related to public health situational awareness planning, made by the National Preparedness and Response Science Board. We obtained and reviewed documents related to the implementation of information technology to enhance public health situational awareness including HHS’s 2014 Public Health and Medical Situational Awareness Strategy and 2015 Public Health and Medical Situational Awareness Strategy Implementation Plan, and the National Preparedness and Response Science Board’s recommendations published in October 2013. We compared information documented in the strategy and implementation plan, and the board’s recommendations, to the required activities and network elements in the law to determine whether they were included in the plans for establishing an electronic public health situational awareness network. We analyzed actions described in the implementation plan to determine which were significant to the development of new IT capabilities or enhancements to existing systems that would be needed to establish the network capabilities. We focused our study on those actions. We also reviewed a January 2017 status report related to HHS’s efforts to address the PAHPRA requirements. As part of our review, we identified systems that HHS reported had been developed and are currently used within HHS’s Secretary’s Operations Center to support public health emergency preparedness and response functions. We examined descriptions of the systems to identify the data sources accessed for information sharing within HHS and among other public health entities. We then compared the data sources to technical requirements defined by PAHPRA and determined the extent to which the systems were used to collect and share information in accordance with the law. We examined HHS’s enterprise lifecycle processes for managing and overseeing IT resources, along with other guidance provided by the Office of Management and Budget, to identify the roles, responsibilities, and authority needed to conduct actions that would need to be completed in order to implement the IT capabilities described in the plans. We then compared the contents of the strategy and plan against the department’s processes and the other federal guidance to determine whether HHS had addressed key elements of implementation planning and followed departmental processes for establishing and managing the IT resources needed to implement the IT-related actions included in the implementation plan. To supplement the information we collected from examination of documentation, we held discussions with HHS officials to better understand the processes they followed and steps they took to develop the strategy and implementation plan. We also discussed with them their responsibilities for establishing the network and the status of any progress that had been made toward completing actions to address the mandate. In addition, we interviewed an official of the National Preparedness and Response Science Board to gain an understanding of the recommendations made to HHS related to planning efforts to address the modernization and enhancement of biosurveillance systems, as required by PAHPRA. We assessed the reliability of the data we obtained from documented descriptions of HHS systems by reviewing related technical documentation and interviewing department officials knowledgeable of the efforts taken to address the electronic information-sharing requirements of PAHPRA. We found the data reliable for the purposes of our report. We conducted this performance audit from February 2016 to September 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 3 provides an overview of the Office of the Assistant Secretary for Preparedness and Response’s situational awareness systems, the users they were developed to support, entities that provide data, and the data the systems were designed to share that are required by the Pandemic and All-Hazards Preparedness Reauthorization Act of 2013. In addition to the contact named above, Teresa F. Tucker (Assistant Director), Thomas E. Murphy (Analyst in Charge), Melina I. Asencio, Christopher G. Businsky, Quintin I. Dorsey, and Nancy E. Glover contributed to this report.

Summary: A public health event, such as a widespread disease outbreak or health problems resulting from a weather-related emergency, could have catastrophic consequences for the nation. These potential threats can be partially mitigated by having a national public health situational awareness capability—that is, a capability for public health officials to be able to access real-time information about emerging threats to enable them to make timely, responsive decisions to prepare for and respond to emergencies. PAHPRA required HHS to establish a near real-time electronic nationwide public health situational awareness capability through an interoperable network of systems. PAHPRA also included a provision for GAO to evaluate HHS's progress in developing such a capability. This report addresses what progress HHS has made toward establishing the network. GAO analyzed documents describing HHS's plan for enhancing public health situational awareness and evaluated evidence of actions taken by HHS to establish the network required by PAHPRA. GAO also examined the department's IT planning and management processes and guidance, and interviewed HHS officials. The Pandemic and All-Hazards Preparedness Reauthorization Act of 2013 (PAHPRA) required the Secretary of Health and Human Services (HHS) to establish an electronic nationwide public health situational awareness network and to develop an implementation plan to guide its efforts. The law further required HHS to include in its plan specific activities for incorporating data into the network. HHS developed an implementation plan that identified several actions related to enhancing existing information-sharing capabilities needed to establish the network. However, the actions identified in the plan did not address all of the required activities, such as defining data elements and standards. Until the department addresses all required activities, it will lack an effective tool for ensuring that public health situational awareness network capabilities have been established in accordance with all of the requirements defined by the law. In addition, HHS did not identify measurable steps for completing and tracking the status of the activities required by the law. PAHPRA required HHS to include in its plan the measurable steps to be taken to establish the network. Federal guidance also suggests that implementation plans identify timelines of tasks, cost and resource estimates, and performance metrics that can be used to track and monitor progress toward completing tasks and delivering expected outcomes. According to HHS officials who developed the implementation plan, the department established a committee of policy and planning experts from various federal agencies to define the measurable steps for completing the actions identified in the plan. However, HHS did not assign responsibilities for defining such steps to the committee, and the committee had not done so. Until the department defines measurable steps, it will not have the information and planning tools it needs to make progress toward establishing a network that provides information-sharing capabilities needed by public health entities to prepare for and respond to emergencies, as required by PAHPRA. GAO identified other weaknesses in HHS's planning efforts that have contributed to the department's lack of progress toward establishing the network. Specifically, HHS did not follow guidance developed by its Chief Information Officer (CIO) for managing information technology (IT) resources. According to the guidance, officials who manage IT initiatives are to involve a governance organization led by HHS's CIO and designate a project team that includes a project manager and business owner. The team is to manage and oversee initiatives according to the guidance, including the development of a project management plan that identifies timelines and schedules, estimated project resources and costs, and performance metrics for tracking any progress made toward completing tasks and delivering expected outcomes. However, HHS did not designate such a team and did not involve the CIO in its planning efforts. As such, the department lacks the structure and mechanisms needed to plan, manage, and oversee actions for establishing the network. Until HHS adheres to its own guidance for managing the IT resources necessary to improve electronic information-sharing capabilities of systems and networks in use by public health entities throughout the country, it will likely continue to fall short in its efforts to establish the nationwide public health situational awareness network required by PAHPRA. GAO is recommending that HHS complete a plan that includes all actions for establishing the network, develop a project management plan that identifies measurable steps for completing the actions, and conduct IT management processes according to CIO guidance. HHS had no comments on the report or recommendations.