On June 12, 2002, Congress passed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, which requires specific activities related to bioterrorism preparedness and response. For example, it calls for steps to improve the nation’s preparedness for bioterrorism and other public health emergencies by increasing coordination and planning for such events; developing priority countermeasures; and improving state, local, and hospital preparedness and response. The Secretary of HHS is required to provide for the establishment of an integrated system or systems of public health alert communications and surveillance networks among (1) federal, state, and local public health officials; (2) public and private health-related laboratories, hospitals, and other health care facilities; and (3) any other entities that the Secretary determines are appropriate. These networks are to allow for secure and timely sharing and discussion of essential information concerning bioterrorism and other public health emergencies, as well as recommended methods for responding to such an attack or emergency. In addition, no later than 1 year after the enactment of the law, the Secretary, in cooperation with health care providers and state and local public health officials, was to establish any additional technical and reporting standards, including those for network interoperability. Since fiscal year 2002, HHS has funded over $2.7 billion for public health preparedness efforts through grants administered by CDC and just over $1 billion for hospital preparedness grants administered by the Health Resources and Services Administration. To encourage the integration of health care system response plans with public health department plans, HHS has incorporated both public health preparedness and hospital performance goals into the agreements that the department uses to fund state and local public health preparedness improvements. The funding guidance provided by HHS to state and local governments calls for improvements in seven key areas: preparedness planning and readiness assessment, surveillance and epidemiology capacity, laboratory capacity for handling biological agents, laboratory capacity for handling chemical agents, health alert network/communication and IT, risk communication and health information dissemination, and education and training. Over the past year, federal actions to encourage the use of IT for health care delivery and public health have been accelerated. In April 2004, the President established the goal that health records for most Americans should be electronic within 10 years and issued an executive order to “provide leadership for the development and nationwide implementation of an interoperable health information technology infrastructure to improve the quality and efficiency of health care.” As part of this effort, the President tasked the Secretary of HHS to appoint a National Coordinator for Health Information Technology—which he subsequently did 1 week later. The President’s executive order called for the Coordinator to develop a strategic plan to guide the implementation of interoperable health IT in the public and private health care sectors. In July 2004, HHS issued a framework for strategic action that includes four broad goals; goal four of that framework is directed at improvements in public health. Further, DHS released the National Response Plan this past January, under which HHS is to continue to lead the federal government in providing public health and medical services during major disasters and emergencies. In this role, HHS is to coordinate all federal resources related to public health and medical services that are made available to assist state, local, and tribal officials during a major disaster or emergency. As we reported in May 2003, IT can play an essential role in supporting federal, state, local, and tribal governments in public health preparedness and response. Development of IT can build upon the existing systems capabilities of state and local public health agencies, not only to provide routine public health functions, but also to support public health emergencies, including bioterrorism. In addition, according to the Institute of Medicine, the rapid development of new IT offers the potential for greatly improved surveillance capacity. Finally, for public health emergencies in particular, the ability to quickly exchange data between providers and public health agencies—or among providers—is crucial in detecting and responding to naturally occurring or intentional disease outbreaks. Because of the dynamic and unpredictable nature of public health emergencies, various types of IT systems may be used during the course of an event. These include surveillance systems, which facilitate the performance of ongoing collection, analysis, and interpretation of disease-related and environmental data so that responders and decision makers can plan, implement, and evaluate public health actions (these systems include devices to collect and identify biological agents from environmental samples, and they make use of IT to record and transmit data); and communications systems, which facilitate the secure and timely exchange of information to the relevant responders and decision makers so that appropriate action can be taken. Other types of IT may also be used, such as diagnostic systems, which identify particular pathogens and those that include data from food, water, and animal testing, but such systems are not among the major federal public health IT initiatives. Although state health departments have primary responsibility for disease surveillance in the United States, total responsibility for surveillance is shared among health care providers: more than 3,000 local county, city, and tribal health departments; 59 state and territorial health departments; more than 180,000 public and private laboratories; and public health officials from multiple federal agencies. In addition, the United States is a member of the World Health Organization, which is responsible for coordinating international disease surveillance and response actions. While health care providers are responsible for the medical diagnosis and treatment of their individual patients, they also have a responsibility to protect public health—a responsibility that includes helping to identify and prevent the spread of infectious diseases. Because health care providers are typically the first health officials to encounter cases of infectious diseases—and have the opportunity to diagnose them—these professionals play an important role in disease surveillance. Generally, state laws or regulations require health care providers to report confirmed or suspected cases of notifiable diseases to their state or local health department. States publish lists of the diseases they consider notifiable and therefore subject to reporting requirements. According to the Institute of Medicine, most states also require health care providers to report any unusual illnesses or deaths, especially those for which a cause cannot be readily established. However, according to CDC, despite state laws requiring the reporting of notifiable diseases, a significant proportion of these cases are not reported, which is a major challenge in public health surveillance. Health care providers rely on a variety of public and private laboratories to help them diagnose cases of notifiable diseases. In some cases, only laboratory results can definitively identify pathogens. Every state has at least one public health laboratory to support its infectious diseases surveillance activities and other public health programs. State laboratories conduct testing for routine surveillance or as part of clinical or epidemiologic studies. For rare or unusual pathogens, these laboratories provide diagnostic tests that are not always available in commercial laboratories. State public health laboratories also provide specialized testing for low-incidence but high-risk diseases such as tuberculosis and botulism. Results from state public health laboratories are used by epidemiologists to document trends and identify events that may indicate an emerging problem. Upon diagnosing a case involving a notifiable disease, local health care providers are required to send the reports to state health departments through state and local disease-reporting systems, which range from paper-based reporting to secure, Internet-based systems. States, through their state and local health departments, have principal responsibility for protecting the public’s health and therefore take the lead in conducting disease surveillance and supporting response efforts. Generally, local health departments are responsible for conducting initial investigations into reports of infectious diseases, employing epidemiologists, physicians, nurses, and other professionals. Local health departments are also responsible for sharing information that they obtain from providers or other sources with the state department of health. State health departments are responsible for collecting surveillance information statewide, coordinating investigations and response activities, and voluntarily sharing surveillance data with CDC and others. States vary in their requirements governing who should report notifiable diseases; in addition, the deadlines for reporting these diseases after they have been diagnosed vary by disease. State health officials conduct their own analyses of disease data to verify cases, monitor the incidence of diseases, and identify possible outbreaks. In reporting their notifiable disease data to CDC, states use multiple and sometimes duplicative systems. States are not legally required to report information on notifiable diseases to CDC, but CDC officials explained that the agency makes such reporting from the states a prerequisite for receiving certain types of CDC funding. Generally, the federal government’s role in disease surveillance is to collect and analyze national disease surveillance data and maintain disease surveillance systems. Federal agencies investigate the causes of infectious diseases and maintain their own laboratory facilities. They also use communications systems to share disease surveillance information. In addition, federal agencies provide funding and technical expertise to support disease surveillance at the state, local, and international levels. Federal agencies such as CDC, the Food and Drug Administration, and DOD conduct disease surveillance using systems that gather data from various locations throughout the country to monitor the incidence of infectious diseases. In addition to using surveillance systems to collect and analyze notifiable disease data reported by states, federal agencies use other surveillance systems to collect data on different diseases or from other sources (e.g., international sources). These systems supplement the state data on notifiable diseases by monitoring surveillance information that states do not collect. In general, surveillance systems are distinguished from one another by the types of infectious diseases or syndromes they monitor and the sources from which they collect data. Some disease surveillance systems rely on groups of selected health care providers who have agreed to routinely supply information from clinical settings on targeted diseases. A relatively new type of surveillance system, known as a syndromic surveillance system, monitors the frequency and distribution of health-related symptoms—or syndromes—among people within a specific geographic area. These syndromic surveillance systems are designed to detect anomalous increases in certain syndromes, such as skin rashes, that may indicate the beginning of an infectious disease outbreak. Some monitor data from hospital and emergency room admissions or data from over-the- counter drug sales. Other data sources may include poison control centers, health plan medical records, first-aid stations, emergency medical service data, insurer claims, and discharge diagnosis information. For syndromic data to be analyzed effectively, information must be timely, and the analysis must take into account the context of the locality from which the data were generated. Because syndromic surveillance systems monitor symptoms and other signs of disease outbreaks instead of waiting for clinically confirmed reports or diagnoses of a disease, some experts believe that syndromic surveillance systems could help public health officials increase the speed with which they may identify outbreaks. However, as we reported last September, syndromic surveillance systems are relatively costly to maintain compared with other types of disease surveillance and are still largely untested. Two federal agencies are involved in major public health IT initiatives that focus on disease surveillance and communications. CDC, one of HHS’s divisions, has primary responsibility for conducting national disease surveillance and developing epidemiological and laboratory tools to enhance surveillance of disease, including public health emergencies. It also provides an array of technical and financial support for state infectious disease surveillance. DHS’s mission involves, among other things, protecting the United States against terrorist attacks, including bioterrorism. Its Science and Technology (S&T) Directorate serves as the department’s primary research and development arm. Its focus is on catastrophic terrorism— threats to the security of the United States that could result in large- scale loss of life and major economic impact. S&T’s work is designed to counter those threats, both by improvements to current technological capabilities and development of new ones. (Other federal agencies’ roles in public health are described in app. II.) CDC’s major IT initiative, known as PHIN, is a national initiative to implement a multiorganizational business and technical architecture for public health information systems. After the 2001 anthrax incidents, CDC was mandated to increase national preparedness and capabilities to respond to naturally occurring diseases and conditions and the deliberate use of all threats, including biological, chemical, and radiological agents. CDC sees PHIN as an essential part of its strategy to achieve this mandate. According to CDC, the PHIN architecture defines and documents the systems needed to support public health identifies the industry standards that are necessary to make these develops the specifications necessary to make these standards do the work of public health; defines integration points for systems to work together to meet the establishes tools and components that support standards-based supports the certification process necessary to establish interoperability. To help achieve its goals, PHIN is also intended to integrate and coordinate existing systems, and CDC makes PHIN software available for optional use by state and local public health agencies. PHIN has substantial size and scope, because it is intended to serve as a comprehensive architecture, information exchange network, and set of services that will integrate existing capabilities and advance the ways in which IT can support public health. It is intended to improve public health systems and networks and to provide a means for exchanging data with other federal agencies, state and local government agencies, the private health care sector, and others. As part of PHIN, CDC has established the PHIN Preparedness initiative, which it describes as striving to accelerate the pace at which jurisdictions acquire or acquire access to public health preparedness systems. This initiative focuses on the near-term aspects of PHIN. According to CDC, the agency and its public health partners have identified a set of functional requirements defining the core capabilities for preparedness systems; these are categorized into six broad functional areas: Early event detection: The early identification of bioterrorism and naturally occurring health events in communities. Outbreak management: The capture and management of information associated with the investigation and containment of a disease outbreak or public health emergency. Connection of laboratory systems: The development and adoption of common specifications and processes to enable public health laboratories to electronically exchange information with public health agencies. Countermeasure and response administration: The management and tracking of measures taken to contain an outbreak or event and to provide protection against a possible outbreak or event. Partner communications and alerting: The development of a nationwide network of integrated communications systems capable of rapid distribution of health alerts and secure communications among public health professionals involved in an outbreak or event. Cross-functional components: Technical capabilities, or components, common across functional areas that are necessary to fully support PHIN Preparedness requirements. CDC officials stated that by September 2005, the agency will expect states to meet PHIN Preparedness requirements in these areas as a condition for receiving public health preparedness funding; CDC expects that this condition on funding will promote a wider adoption of PHIN standards. Table 1 presents communications and surveillance applications that are part of the PHIN initiative (some of which are significant system development efforts in themselves), along with the PHIN Preparedness functional areas that they support. Many of these applications are associated with larger initiatives that predated PHIN (see table 2), which are now incorporated under the PHIN umbrella. For example, the origins of NEDSS date to 1995, when CDC co- authored a report that documented the problems of fragmentation and incompatibility in the nation’s disease surveillance systems. The recommendations in this report led CDC to develop the NEDSS initiative, which was begun in October 1999 and incorporated into PHIN in 2002. As part of its mission to protect the nation against terrorist attacks (including possible bioterrorism), DHS is also pursuing major public health IT initiatives. These initiatives and associated programs, which are primarily focused on signal interpretation and biosurveillance, are described in table 3. Figure 1 illustrates a simplified flow of existing surveillance information and health alerts among local, state, and federal agencies. This diagram does not show all flows of information that would occur in the case of an outbreak. For example, local health agencies may send alerts to health care providers. According to CDC, costs for its PHIN initiatives and applications for fiscal years 2002 through 2005, totaling almost $362 million, are summarized in table 4. Most of these costs support local, state, and federal public health activities. According to DHS, IT costs for its biosurveillance initiatives for fiscal years 2003 through 2005 total about $45 million; these are summarized in table 5. This table does not reflect the total costs for the programs supporting these IT initiatives. CDC and DHS have made progress on federal public health IT initiatives, including CDC’s PHIN initiative, which is intended to provide the nation with integrated public health information systems to counter national civilian public health threats, and two major initiatives at DHS—primarily focused on signal interpretation and biosurveillance—one of which is associated with three other programs. However, while progress has been made, more work remains, particularly in surveillance and data exchange. PHIN communications systems are being used, and improvements to surveillance systems (disease, syndromic, and environmental monitoring) are still being developed. Other PHIN applications are available for optional use by state and local public health officials, but they are not widely used because of system limitations. DHS’s two major biosurveillance IT initiatives are still in the development stage, and one of the associated programs—BioWatch—is operational. However, as initially deployed, BioWatch required modification, because its three IT components did not communicate with each other, requiring redundant data entry. According to DHS, it has developed a solution to this interoperability problem and implemented it at two locations; DHS plans to install that solution in the remaining BioWatch locations. Table 6 briefly describes the status of CDC’s PHIN applications, including operational status, number of installations or users, and future plans. Of the various PHIN applications, one is still in the planning process, two are partially operational, and five are operational. Figure 2 shows the time frames for the planning, development, and implementation of the PHIN applications; these applications vary considerably both in complexity and in time needed to complete implementation. Health Alerting. The Health Alerting application, which is used to broadcast e-mail alerts to state and local public health officials about disease outbreaks, became operational in October 2000. This application provides full-time (24 hours a day, 7 days a week) Internet access and broadcast e-mail and fax capabilities. The Health Alerting application is part of the Health Alert Network initiative, which provides grant funding to states and local public health agencies for enhancement of their IT infrastructures. Using these funds, states and localities have either built their own Health Alert Networks or acquired commercial systems for alerting state and local officials. Some state Health Alert Networks use more sophisticated applications than the CDC Health Alerting application, providing various kinds of alerts based on user profiles and allowing document sharing. Epi-X. Epi-X, which is designed to be a secure, Web-based communications system through which public health professionals share information on public health emergencies, was implemented in December 2000 and is being used by state and local public health officials. Epi-X includes multiple mechanisms for alerting; secure, moderated communications and discussion about disease outbreaks and other acute health events as they evolve; and a searchable report database. Most of the state and local health officials with whom we spoke were satisfied with the system. However, some officials questioned the need for both Health Alerting and Epi-X, since both applications have similar functionality and are used by some of the same public health officials. According to CDC, it is planning to create a common platform for use by both applications. The National Electronic Disease Surveillance System (NEDSS). The NEDSS initiative promotes the use of data and information systems standards for the development of interoperable surveillance systems at federal, state, and local levels. It is intended to minimize the problems of fragmented, disease-specific surveillance systems; however, this goal is still years away from being achieved. A primary goal of NEDSS is the ongoing, automatic capture and analysis of data that are already available electronically. Its system architecture is designed to integrate and replace several current CDC surveillance systems, including the National Electronic Telecommunications System for Surveillance, the HIV/AIDS reporting system, and the systems for vaccine preventable diseases, tuberculosis, and other infectious diseases. In previous fiscal years, CDC funded 50 states and 7 localities. These states and localities can use CDC’s NEDSS Base System or build systems compatible with NEDSS/PHIN standards. The initiative includes an architecture to guide states and CDC as they build NEDSS-compatible systems, which can be either commercial or custom developed. The initiative is also intended to promote the use of data standards to advance the development of interoperable disease surveillance systems at federal, state, and local levels. Besides providing a secure, accurate, and efficient way to collect, process, and transmit data to CDC, the NEDSS Base System is intended to provide a platform upon which program area modules can be built to meet state and program area data needs. (Programs may be focused on specific diseases, populations, or other areas—such as smoking or obesity.) Program area modules are critical to eventually reducing the many program-specific surveillance systems that CDC currently maintains by consolidating the data collection of the various programmatic disease surveillance activities that are currently in place. Although CDC has been developing the NEDSS Base System since 2000, it is still only partially deployed. There are no clear milestones and plans for when the Base System will become fully deployed, although multiple versions of the Base System have been developed and deployed in several states. According to CDC, the NEDSS Base System has been deployed in 5 states since December 2004, and it expects implementation to continue with the 11 remaining states that are planning to use the Base System, but the implementation time frames will depend on when these states are ready to accept the system. Table 7 summarizes the status of NEDSS system implementation across the nation, which shows that about half of the states and localities have operational NEDSS systems. In addition, four NEDSS program area modules are being used, and six are in the process of being developed. Additional program area modules will be developed for other disease-specific areas in the coming years. BioSense. CDC’s BioSense, which the agency describes as an early event detection system, is designed to provide near real-time event detection by using data (without patient names or medical numbers) from existing health-related databases. Although CDC began using BioSense data in late 2003, the BioSense application was implemented for state and local use in May 2004. BioSense is continuously being updated, and current plans for phase two of BioSense development call for enhancements to begin in May 2005. BioSense is a Web-based application that currently provides CDC and state and local users with the ability to view syndromic and prediagnostic data: specifically, Defense and Veterans Affairs ambulatory care data, BioWatch laboratory results, and national clinical labs data. Initially, CDC also provided data on sales of over-the-counter medication, but these were later discontinued. BioSense data are provided in the form of data reports displayed in various ways, rather than as raw data that can be input to analytical systems. Although CDC uses BioSense for a number of federal bioterrorism preparedness activities, BioSense is not extensively used by the state and local public health officials with whom we spoke, primarily because of limitations in the data and its presentation. These officials stated that the DOD and VA data were not useful to them, either because they were in locations without large military or veteran populations, or because they could get similar data elsewhere. For instance, many of these officials have access to local syndromic surveillance systems, which better fit their needs because the systems have better capabilities or because they provide data that are more timely than BioSense data. Some of these officials stated that they would prefer CDC to provide data for them to conduct their own analyses, especially data from national sources such as clinical laboratories, rather than displaying the data on the BioSense Web site. According to CDC officials, they will provide raw data to public health agencies upon request, have increased the number of data sets available, and have expanded the scope of user support by (1) increasing communications with state and local public health departments in the use of and response to daily surveillance data patterns, (2) monitoring data during special events (e.g., a presidential inauguration and sporting events) at state and local request, and (3) contracting with John Hopkins University for development of a standard operating procedure for monitoring and using early event detection. National Environmental Public Health Tracking Network (NEPHTN). Initiated in 2001, NEPHTN is still in the planning stage. CDC is planning to begin development of the network in 2006 and implementation of phase one in 2008. This initiative involves intra- and interagency collaboration among CDC and other federal agencies. CDC established a memorandum of understanding in 2003 with the Environmental Protection Agency (EPA) to coordinate activities relating to EPA’s National Environmental Information Exchange Network and CDC’s National Environmental Public Health Tracking Network. To date, three collaborative projects have been initiated: (1) a demonstration project in the Atlanta metropolitan area to test data linkage methods and utility of linked data; (2) a project to evaluate how different types of air quality characterization data can be used to link environmental and public health data; and (3) a project in New York to examine specific technical interoperability issues that would affect data exchange between EPA’s and CDC’s networks. As envisioned, NEPHTN will be a distributed, secure, Web-based network that will provide access to environmental and health data that are collected by a wide variety of agencies, such as individual state networks. Once established, it should also provide access to environmental, health, and linked environmental-health data from both centralized and decentralized data stores and repositories, implementing a common data vocabulary to support electronic data exchanges within states, and across state, regions, and nationally. Outbreak Management System. The Outbreak Management System is an application designed for case tracking during the investigation of disease outbreaks. Initially developed for use by CDC, the system is now available for use by state and local public health agencies. The project began as the Bioterrorism Field Response Application and was scoped to include only requirements related to bioterrorism response by CDC-deployed field teams. Since its inception in 2002, the scope has been broadened to include any epidemiologic investigation where standard data collection and data sharing would be advantageous. However, although the system is in use at CDC, none of the state and local public health officials with whom we spoke use the system—either because it cannot exchange data with other software applications, or because these agencies have their own capability for tracing cases of infectious diseases. According to CDC officials, the use of the Outbreak Management System is provided as an option for state and local public health agencies. Although only CDC and one state agency have used the application in support of outbreaks, four state agencies and one federal entity have evaluated the software for potential use and may implement it in the future. LRN Results Messenger. CDC’s LRN Results Messenger utility is used by DHS’s BioWatch initiative for transmitting data to CDC; however, it is burdensome to use, according to the BioWatch cities included in our review (BioWatch is discussed in more detail in the next section of this report). According to CDC, it anticipates releasing the next version of the LRN Results Messenger in September 2005, which should address the usability issues. PHIN Messaging System. The PHIN Messaging System is available for use, but only CDC and a few states and local public health agencies use it. As of March 1, 2005, 51 organizations used it, according to CDC. As yet, only BioWatch, the NEDSS Base System, and the Laboratory Response Network use PHIN Messaging; according to CDC, these are the major systems that support preparedness needs, and it is focusing on these systems first. DHS is also pursuing two major biosurveillance IT initiatives—the National Biosurveillance Integration System and the Biological Warning and Incident Characterization System (BWICS). The BWICS initiative, in addition, is associated with three other biosurveillance programs. Of these five, one is operational, but it has interoperability and other limitations, one is a demonstration project, and three are in development. All five were initially under the oversight of DHS’s S&T Directorate; one is now the responsibility of the directorate for Information Analysis and Infrastructure Protection. Table 8 briefly describes the status and plans of DHS’s biosurveillance IT initiatives for the current fiscal year. Most of DHS’s biosurveillance IT initiatives are still being planned or developed. Figure 3 shows time lines for the five DHS IT initiatives. The one DHS surveillance initiative that is operational—BioWatch—is an environmental monitoring system that was developed and implemented within a 3-month period, according to DHS officials. DHS originally intended for local public health agencies to process and analyze all BioWatch data; however, at CDC’s request, DHS agreed to share data with CDC for inclusion in BioSense. BioWatch consists of three IT components: One component of BioWatch tracks the environmental samples as they are collected; it was developed by the Department of Energy’s Los Alamos National Laboratory. A second component performs sample testing and reports the results; this is a commercial product. The third component, CDC’s LRN Results Messenger, transmits the test results from the laboratory that processes the samples to CDC for analysis. As deployed, none of these three components could exchange data electronically, so that redundant, manual data entry has been required to transfer data among the three systems. State and local public health officials in BioWatch locations told us that they were dissatisfied with the deployment of BioWatch because of this need for repetitive data entry and because they were not involved in the system’s planning and implementation. DHS hired a contractor to resolve BioWatch’s interoperability problem, and DHS officials now report that they have begun implementing the resulting technical improvements in BioWatch laboratories. Additionally, EPA’s Inspector General’s Office recently reported that the agency did not provide adequate oversight of sampling operations for BioWatch to ensure that quality assurance guidance was adhered to, potentially affecting the quality of the samples taken; DHS officials state that this oversight issue has now been resolved. In the broader context of environmental monitoring, questions exist about detection capabilities for environmental surveillance. As we reported in May 2003, real-time detection and measurement of biological agents in the environment is challenging because of the number of potential agents to be identified, the complex nature of the agents themselves, the countless number of similar micro-organisms that are a constant presence in the environment, and the minute quantities of pathogen that can initiate infection. In May 2004, the Department of Defense reported that the capability for real-time detection of biological agents is currently unavailable and is unlikely to be achieved in the near to medium term. A second initiative, the BioWatch Signal Interpretation and Integration Program (BWSIIP), was established to respond to user needs regarding BioWatch. According to DHS, the initiative is intended to develop a system that will help BioWatch jurisdictions to better understand the public health or national security implications of a confirmed positive result for a biological agent from BioWatch, as well as to respond appropriately. BWSIIP is to be implemented by a consortium, initiated in 2004, that includes Carnegie Mellon University, the University of Pittsburgh, and the John Hopkins University Applied Physics Laboratory. The current BWSIIP pilot is scheduled for completion in fiscal year 2006. After DHS transitions BWSIIP to the BWICS initiative, local public health agencies will use locally available applications or tools provided by DHS for that function. For the two remaining major biosurveillance IT initiatives, DHS is still developing requirements (lessons learned from its one demonstration project, BioNet, are being incorporated into BWICS). BWICS, is to integrate data from environmental monitoring and health surveillance systems, and the pilot is expected to be completed in fiscal year 2006, according to DHS officials. DHS did not complete requirements development in the two pilot cities as scheduled, and it recently changed one of the original pilot cities, requiring a new start in requirements development in the new location. After the pilot, DHS is planning to expand BWICS beyond the two pilot cities to other BioWatch locations. The National Biosurveillance Integration System is intended to connect the various federal surveillance systems to DHS’s Homeland Security Operations Center. DHS S&T developed the system requirements and design and transferred the initiative to the Directorate for Information Analysis and Infrastructure Protection in December 2004 for implementation. Despite federal, state, and local government efforts to strengthen the public health infrastructure and improve the nation’s ability to detect, prevent, and respond to public health emergencies, important challenges continue to constrain progress. First, the national health care IT strategy and federal health architecture are still being developed; CDC and DHS will face challenges in integrating their public health IT initiatives into these ongoing efforts. Second, although federal efforts continue to promote the adoption of data standards, developing such standards and then implementing them are challenges for the health care community. Third, these initiatives involve the need to coordinate among federal, state, and local public health agencies, but establishing effective coordination among the large number of disparate agencies is a major undertaking. Finally, CDC and DHS face challenges in addressing specific weaknesses in IT planning and management that may hinder progress in developing and deploying public health IT initiatives. In May 2003, we recommended that the Secretary of HHS, in coordination with other key stakeholders, establish a national IT strategy for public health preparedness and response that should identify steps toward improving the nation’s ability to use IT in support of the public health infrastructure. Among other things, we stated that HHS should set priorities for information systems, supporting technologies, and other IT initiatives. Since then, HHS appointed a National Coordinator for Health IT in May 2004 and issued a framework for strategic action in July 2004. This framework is a first step in the development of a national health IT strategy. Goal four of the framework is directed at improvements in public health and states that these improvements require the collection of timely, accurate, and detailed clinical information to allow for the evaluation of health care delivery and the reporting of critical findings to public health officials. Two of the strategies outlined by HHS are aimed at achieving this goal: (1) unifying public health surveillance architectures to allow for the exchange of information among health care organizations, organizations they contract with, and state and federal agencies and (2) streamlining quality and health status monitoring to allow for a more complete look at quality and other issues in real time and at the point of care. The framework for strategic action states that the key challenge in harmonizing surveillance architectures is to identify solutions that meet the reporting needs of each surveillance function, yet work in a single integrated, cost- effective architecture. Like the national health care IT strategy, the federal health architecture is still evolving, according to HHS officials in the Office of the National Coordinator for Health IT. Initially targeting standards for enabling interoperability, the federal health architecture is intended to provide a structure for bringing HHS’s divisions and other federal agencies together. As part of achieving HHS’s public health goal of unifying public health surveillance architectures, the federal health architecture program established a work group on public health surveillance that is responsible for recommending a target architecture related to disease surveillance to serve as the framework within the federal sector for developing and implementing public health surveillance systems. The newly formed work group, chaired by CDC and the Department of Veterans Affairs, met for the first time in December 2004. Because the new work group is so recently formed, plans are still being developed to address how CDC’s PHIN initiative and DHS’s IT initiatives will integrate with the national health IT strategy, such as plans to establish regional health information organizations. In the absence of a completed strategy for public health surveillance efforts, state and local public health officials have raised concerns about duplication of effort across federal agencies. Some of the surveillance initiatives in our review address similar functionality and may duplicate ongoing efforts at other federal, state, and local agencies: for example, the use and development of syndromic surveillance systems. CDC is implementing BioSense at the national level, DHS is assisting local public health agencies in implementing local syndromic surveillance systems such as ESSENCE or RODS as part of its biosurveillance initiatives, and many state and local public health agencies have their own ongoing syndromic surveillance systems. As we have reported, syndromic surveillance systems are relatively costly to maintain compared with other types of disease surveillance and are still largely untested. According to HHS, with regard to BioSense, the agency is taking steps to mitigate costs and risk. State and local public health officials also expressed concern about the federal government’s ability to conduct syndromic surveillance, because they see this type of surveillance as an inherently local function. Furthermore, last year the Council of State and Territorial Epidemiologists reported that while state health departments are given some guidance and leeway to use federal funding to enhance and develop their own disease surveillance activities, no focused mechanism has been established for states to share ideas and experiences with each other and with CDC to determine what has or has not worked, and what efforts are feasible and worth expanding. The Council recommended that to enhance bioterrorism-related surveillance objectives, HHS and CDC form a bioterrorism surveillance initiative steering committee to review current federal surveillance initiatives affecting state and local health departments; to review state-developed surveillance systems; and to recommend surveillance priorities for continuation of funding, further development, or implementation. HHS and CDC have taken steps to respond to these recommendations, but according to the Council, it is not yet satisfied that HHS and CDC have fully addressed its concerns. While HHS and other key federal agencies are organizing themselves to develop a strategy for public health surveillance and interoperability, decisions regarding development and implementation are being made now without the benefit of an accepted national health IT strategy that integrates public health surveillance-related initiatives. In the case of BioSense, these decisions affect the spending of about $50 million this fiscal year and an unknown amount in future years. Until a strategy and accompanying architecture are developed, major public health IT initiatives will continue to be developed without an overall, coordinated plan and are at risk of being duplicative, lacking interoperability, and exceeding cost and schedule estimates. In May 2003, we recommended that the Secretary of HHS, as part of his efforts to develop a national strategy, (1) define activities for ensuring that the various standards-setting organizations coordinate their work and reach further consensus on the definition and use of standards, (2) establish milestones for defining and implementing all standards, and (3) create a mechanism to monitor the implementation of standards throughout the health care industry. To support the compatibility, interoperability, and security of federal agencies’ many planned and operational IT systems, the identification and implementation of data, communications, and security standards for health care delivery and public health are essential. As we testified in July 2004, HHS has made progress in identifying standards. While federal action to promote the adoption of these standards continues, the identification and implementation of these standards are an ongoing process. Despite progress in defining health care IT standards, several implementation challenges remain to be worked out, including the establishment of milestones. Currently, no formal mechanisms are in place to ensure coordination and consensus among these initiatives at the national level. HHS officials agree that leadership and direction are still needed to coordinate the various standards-setting initiatives and to ensure consistent implementation of standards for health care delivery and public health. Within the federal health architecture structure, the Consolidated Health Informatics initiative is focused on the adoption of data and communication standards to be used by federal agencies to achieve interoperability of IT within health IT initiatives. In March 2003, the Consolidated Health Informatics initiative announced the adoption of 5 standards, and in May 2004, it announced the adoption of another 15 standards. Some of these standards are included as PHIN standards. As of March 1, 2005, CDC has adopted several industry standards and published specifications for PHIN; these standards are grouped by type in table 9. CDC has also initiated a PHIN certification process for its partners (e.g., state and local public health agencies), which is intended to establish whether state and local systems can meet standards for the PHIN preparedness functional areas. In the future, CDC plans to require system owners to first perform self-assessment reviews to ensure that systems meet PHIN standards, followed by reviews by CDC certification teams to confirm PHIN compatibility. To be functionally compatible, systems must be capable of supporting the standards outlined for each PHIN functional area; accordingly, partners must demonstrate that their systems have this capability. In general, state and local public health officials consider the PHIN initiative to be a good framework for organizing the necessary standards for public health interoperability. Most of the state and local officials we spoke with agreed that CDC has done a commendable job of adopting and promoting standards for IT in selected programs. In addition, they agreed that CDC should continue to take a leadership role in pressing for industry standards and providing guidance to states and local entities. However, several officials stated that CDC should focus more of its attention on setting standards and less on developing software applications, which generally do not meet their needs and are not compatible with their specific IT environments. CDC officials say that it is important both to promote the use of industry standards and to develop software applications, especially for state and local public health agencies that have limited IT resources. Although federal efforts to promote the adoption of these standards continue, their identification and implementation are an ongoing process. Several implementation challenges remain, including coordination of the various efforts to ensure consensus on standards and establishment of milestones. Until these challenges are addressed, federal agencies will not be able to ensure that their systems can exchange data with other systems when needed. In defining system requirements, federal agencies are challenged by the need to involve such key stakeholders as state and local public health agencies, which are expected to use these systems for reporting data to the federal government. For example, most participating local government agencies and state public health laboratories were told to implement the BioWatch initiative in their metropolitan areas and were given the procedures and software to use for sample management and data collection. According to some public health officials, BioWatch was implemented without a plan for how states and localities would respond to a positive test result, and they were left to develop a response plan after BioWatch had been deployed. One metropolitan area did not implement BioWatch for a year after it became operational, because officials did not have a response plan in place and did not want to be responsible for responding to a potential incident without a plan for handling positive test results. According to DHS officials, since local officials had received funds for emergency preparedness, it was their understanding that BioWatch locations had response plans in place; DHS officials have since developed a methodology to target funds for specific purposes, such as response plans. CDC has been challenged by the need to coordinate with a diverse range of state and local public health agencies. For example, CDC has found that it is difficult to implement “standard” systems that would address the full range of different needs and levels of IT resources available at the state level. HHS officials told us that the agency strives to address this challenge by developing applications that are based on industry standards. It also provides the standards and specifications to state and local agencies so that they can build or purchase their own systems that can conform to PHIN standards. Nonetheless, there was consensus among many of the state and local officials in our review that federal agencies did not obtain adequate input from state and local officials. A few state officials with whom we spoke said that CDC does not appropriately consider their need to comply with existing state IT architectures. In addition, in an informal e-mail survey, a small group of state chief information officers agreed that federal agencies do not take into consideration state IT architectures. According to the Council of State and Territorial Epidemiologists, no mechanism has yet been established for state and federal partners to collaboratively review initiatives developed over the past 3 years and plan for the future. Instead, the approach to system design and implementation remains top-down, mainly focused on expanding federally designed syndromic surveillance for early outbreak detection without critical review of its usefulness and cost and without systematic review of state-originated systems and needs. The result is that public health responders may not buy in to and use the federally designed systems, potentially constructive state- originated ideas may not get recognition and wider application, and national bioterrorism-related surveillance will be suboptimal. According to CDC, as part of its efforts to obtain state and local input, it hosts an annual PHIN conference and holds meetings with business partner organizations, such as a recent series of meetings on PHIN preparedness requirements with selected state and local officials. In addition, under CDC’s new organizational structure, the new National Center for Public Health Informatics has a division for communications and collaboration with its partners. Further, CDC and DHS have coordinated with each other on specific projects, but that coordination has not been optimal, according to officials from both agencies. According to DHS officials, federal agencies are planning to meet within the next few months to discuss this issue. When asked about their experiences with coordination between CDC and DHS on public health IT initiatives, some of the state and local public health officials included in our review expressed concerns about coordination between the two agencies; one expressed confusion about their roles. Until CDC and DHS establish close coordination on federal public health IT, and state and local public health agencies are more actively involved in the definition and coordination of federal efforts, the effectiveness of the information systems intended to improve disease surveillance and communications may be inadequate. A challenge that both HHS and DHS face in implementing public health IT initiatives is ensuring their effective planning and management. This requires mature, repeatable systems development and acquisition processes to increase the likelihood that projects will be delivered on time and within budget. Key elements of information and technology management include (1) IT investment management and (2) systems development and acquisition management. To help federal agencies address these key elements, we and the Office of Management and Budget have developed guidance that provides a framework on the use of rigorous and disciplined processes for planning, managing, and controlling IT resources. We have previously reported on specific weaknesses at both HHS and DHS, including the lack of robust processes for IT investment management and immature systems development and acquisition practices. We made recommendations to HHS and DHS aimed at improving these practices. HHS and CDC have recently taken steps to improve their control over IT projects, which is an important aspect of IT investment management. Because PHIN and some of its initiatives (i.e., BioSense, NEDSS, the Health Alert Network, and NEPHTN) are considered major investments for fiscal year 2006, they required review by HHS. The HHS IT Investment Review Board conducted budgetary reviews for these applications in June 2004 and recommended that the projects move forward as major IT investments; however, there is no documentation that additional HHS reviews were conducted on PHIN and its major applications until this past February, when HHS began implementing procedures for better monitoring of system development projects. In January 2004, CDC announced its intention to provide greater executive level oversight of IT investments, but it had been reorganizing and did not begin conducting control reviews for major PHIN investments until recently. In May 2004, CDC announced its new center for public health informatics to better coordinate IT projects; this center was formally recognized as operational as of mid-April 2005 when Congress approved CDC’s reorganization. Until CDC and HHS management provides a systematic method for IT investment reviews, they will have difficulty minimizing risks while maximizing returns on these critical public health investments. Regarding CDC’s systems development and acquisition practices, we observed weaknesses in project management that may hinder progress toward achieving PHIN objectives. For some of the projects in this review, we received limited documentation of project managers’ tracking actual dates against baseline schedules, and it appeared that a number of projects had missed internal schedule dates. In November 2004, CDC started requiring project managers to provide status reports to its program management activity office on a biweekly basis. These reports are now required for five of the systems in our review. CDC officials acknowledged that project dates had to be rebaselined; after the rebaselining, CDC officials stated that their projects met official release dates. Early last year, CDC recognized the need for more direct executive involvement in IT governance and management. This fiscal year, CDC began implementing a project management office to oversee public health informatics projects. Establishing this office and institutionalizing its processes while managing new and ongoing IT projects will be a challenge. The new office has initiated new processes to manage project interdependencies, document and track milestones for projects, and formalize project change requests. For example, the office is beginning to track projects biweekly—asking project managers to report on upcoming milestones, their confidence that those milestones will be met, issues for executive attention, staffing problems, and other potential problems. CDC is also implementing a process to standardize project management across the agency. This process is designed to incorporate, among other things, program and project management, capital planning, security certification and accreditation, and system development life-cycle processes. DHS has been operational for just over 2 years, and the department has made progress in establishing key information and technology disciplines. However, as we have reported, these disciplines are not yet fully established and operational. For example, DHS has established an IT investment management process, but this process is still maturing. DHS has also had problems consistently employing rigorous systems development and acquisition practices. DHS did not provide documentation of its oversight of its public health IT investments. According to DHS officials, they plan to submit a capital asset plan and business case for the BWICS initiative this year for review and approval by the DHS IT review board. However, until DHS follows through on its initial actions to address its management, programmatic, and partnering challenges, its IT investments remain at risk. The federal government has made progress on major public health IT initiatives, but significant work remains to be done. CDC’s PHIN initiative includes applications at various stages of implementation; as a whole, however, it remains years away from fully achieving its planned improvement to the public health IT infrastructure. In addition, DHS’s initiatives are still in such early stages that it is uncertain how they will improve public health preparedness. Federal agencies face many challenges in improving the public health infrastructure. CDC and DHS are pursuing related initiatives, but there is little integration among them, and until the national health IT strategy is completed, it is unknown how their integration will be addressed. Implementing health data standards across the health care community is still a work in progress, and until these standards are implemented, information sharing challenges will remain. In addition, state and local public health agencies report that their coordination with federal initiatives is often limited. Until state and local public health agencies are more actively involved in coordination with their federal counterparts, disease surveillance systems will remain fragmented and their effectiveness will be impeded. Finally, the development of robust practices for IT investment management and for systems development and acquisition is a continuing challenge for HHS and DHS, about which we have previously made recommendations. Until agencies address all these challenges, progress toward building a stronger public health infrastructure will be limited, as will the ability to share essential information concerning public health emergencies and bioterrorism. In order to improve the development and implementation of major public health IT initiatives, we recommend that the Secretary of Health and Human Services take the following two actions: ensure that the federal initiatives are (1) aligned with the national health IT strategy, the federal health architecture, and ongoing public health IT initiatives and (2) coordinated with state and local public health initiatives and ensure federal actions to encourage the development, adoption, and implementation of health care data and communication standards across the health care industry to address interoperability challenges associated with the exchange of public health information. We also recommend that the Secretary of Homeland Security align existing and planned DHS IT initiatives with other ongoing public health IT initiatives at HHS, including adoption of data and communications standards. We received written comments on a draft of this report from the Acting Inspector General at HHS and Director of the Departmental GAO/OIG Liaison at DHS (these comments are reproduced in app. III and IV). HHS generally concurred with our recommendations, while DHS did not comment specifically on the recommendations. Both agencies provided additional contextual information and technical comments, which we have incorporated in this report as appropriate. We provided DOD officials with the opportunity to comment on a draft of this report, which they declined. Among its comments, HHS officials stated that this report does not adequately represent the department’s accomplishments in implementing standards and specifications for health IT or the benefits of pursuing a standards-based approach. We concur with HHS on the importance of standards for health information technology and have been calling for federal leadership in expediting standards since 1993. Page 61 lists GAO reports on health IT, several of which address the benefits of standards and the need for a national health IT strategy. In response to HHS’s comment that we suggest that early event detection is duplicative or irrelevant at the federal level, neither we nor the state and local public health officials suggest that early event detection at the federal level is irrelevant. Rather, we are reporting the concerns of state and local public health officials regarding the federal government’s role, which merits further discussion and more involvement of state and local health officials. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of the report to other congressional committees. We will also send copies to the Secretaries of Health and Human Services, Homeland Security, Defense, and Energy. In addition, copies will be sent to the state and local public health agencies that were included in our review. Copies will also be made available at no charge on our Web site at www.gao.gov. If you have any questions on matters discussed in this report, please contact me at 202-512-9286 or by e- mail at pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. The objectives of our review were to assess the progress of major federal information technology (IT) initiatives designed to strengthen the effectiveness of the public health infrastructure and describe the key IT challenges facing federal agencies responsible for improving the public health infrastructure. To address these objectives, we conducted our work at Health and Human Services (HHS), Department of Homeland Security (DHS), and Department of Defense (DOD) offices in Washington, D.C., and the Centers for Disease Control and Prevention (CDC) in Atlanta. We selected specific IT initiatives to review from systems we identified in previous work, focusing on major public health IT initiatives in surveillance and communication systems. We excluded food safety systems and DOD disease surveillance systems that did not include civilian populations. We discussed our selection with federal officials to help ensure that we were addressing the most relevant major initiatives. To assess the progress of major federal IT initiatives designed to strengthen the effectiveness of the public health infrastructure, we analyzed agency documents such as Office of Management and Budget’s Exhibit 300s, minutes of executive council meetings, and system development documents, including project plans, functional requirements, and cost-benefit analyses. We supplemented our evaluation of agency documents with interviews of federal officials. Through interviews with these officials and with state and local public health officials, we also assessed CDC’s and DHS’s interaction and coordination with each other on their IT initiatives. Because these federal initiatives affect state and local public health agencies, we supplemented our analysis of agency documentation by interviewing officials from six state and six local public health agencies on progress being achieved by CDC and DHS. We conducted our work at the San Diego County Health and Human Services Agency; the California Department of Health Services in Sacramento; the Thurston County Public Health and Social Services and the Washington State Department of Health in Olympia; the Austin/Travis County Health and Human Services Department and the Texas Department of State Health Services in Austin; the Milwaukee City Health Department; the Wisconsin Department of Health and Family Services in Madison, Wisconsin; the Boston Public Health Commission and the Commonwealth of Massachusetts Department of Public Health in Boston; the New York State Department of Health in Albany; and the New York City Department of Health and Mental Hygiene. The states and local public health agencies were selected because they were actively involved in implementing at least one of CDC’s Public Health Information Network IT applications. We interviewed them on the impact of federal IT initiatives on state and local public health operations and lessons they learned from integrating federal IT initiatives into their local public health infrastructure. If they had systems similar to the federal systems in our review, we discussed how their systems compared with the federal initiatives. We also interviewed representatives of several public health professional organizations, which CDC considers its partners, such as the National Association of County and City Health Officials, the Association of State and Territorial Health Officials, the Council for State and Territorial Epidemiologists and the Association of Public Health Laboratories. We also had a discussion with the National Association of State Chief Information Officers. To identify key IT challenges facing federal agencies responsible for improving the public health infrastructure, we analyzed published GAO reports, agency documents, and other information obtained during interviews and site visits. We summarized the results of our evaluation and identified the key challenges that CDC and DHS have consistently encountered as they implement the IT initiatives included in our review. Our work was performed from July 2004 through April 2005 in accordance with generally accepted government auditing standards. The Department of Health and Human Services (HHS) has primary responsibility for coordinating the nation’s response to public health emergencies, including bioterrorism. HHS divisions responsible for bioterrorism preparedness and response, and their primary responsibilities, include the following: The Office of the Assistant Secretary for Public Health Emergency Preparedness coordinates the department’s work to oversee and protect public health, including cooperative agreements with states and local governments. States and local governments can apply for funding to upgrade public health infrastructure and health care systems to better prepare for and respond to bioterrorism and other public health emergencies. The office maintains a command center where it can coordinate the response to public health emergencies from one centralized location. This center is equipped with satellite teleconferencing capacity, broadband Internet hookups, and analysis and tracking software. The Centers for Disease Control and Prevention (CDC) has primary responsibility for nationwide disease surveillance for specific biological agents, developing epidemiological and laboratory tools to enhance disease surveillance, and providing an array of scientific and financial support for state infectious disease surveillance, prevention, and control. CDC has an emergency operations center to organize and manage all of its emergency operations, allowing for immediate communication with HHS, the Department of Homeland Security, federal intelligence and emergency response officials, and state and local public health officials. CDC also provides testing services and consultation that are not available at the state level; training on infectious diseases and laboratory topics, such as testing methods and outbreak investigations; and grants to help states conduct disease surveillance. In addition, CDC provides state and local health departments with a wide range of technical, financial, and staff resources to help maintain or improve their ability to detect and respond to disease threats. The Food and Drug Administration is responsible for safeguarding the food supply, ensuring that new vaccines and drugs are safe and effective, and conducting research on diagnostic tools and treatment of disease outbreaks. It is increasing its food safety responsibilities by improving its laboratory preparedness and food monitoring inspections. The Agency for Healthcare Research and Quality is responsible for supporting research designed to improve the outcomes and quality of health care, reduce its costs, address safety and medical errors, and broaden access to effective services, including antibioterrorism research. It has initiated several major projects and activities designed to assess and enhance linkages between the clinical care delivery system and the public health infrastructure. Research focuses on emergency preparedness of hospitals and health care systems for bioterrorism and other public health events; technologies and methods to improve the linkages among the personal health care system, emergency response networks, and public health agencies; and training and information needed to prepare clinicians to recognize the symptoms of bioterrorist agents and manage patients appropriately. The National Institutes of Health is responsible, among other things, for conducting medical research in its own laboratories and for supporting the research of nonfederal scientists in universities, medical schools, hospitals, and research institutions throughout the United States and abroad. Its National Institute of Allergy and Infectious Diseases has a program to support research related to organisms that are likely to be used as biological weapons. The Health Resources Services Administration is responsible for improving the nation’s health by ensuring equal access to comprehensive, culturally competent, quality health care. Its Bioterrorism Hospital Preparedness program administers cooperative agreements to state and local governments to support hospitals’ efforts toward bioterrorism preparedness and response. The Department of Homeland Security (DHS) is responsible for, among other things, protecting the United States against terrorist attacks. One activity undertaken by DHS is coordination of surveillance activities of federal agencies related to national security. The Science and Technology Directorate serves as the primary research and development arm of DHS, using our nation’s scientific and technological resources to provide federal, state, and local officials with the technology and capabilities to protect the nation. The focus is on catastrophic terrorism—threats to the security of our homeland that could result in large-scale loss of life and major economic impact. The directorate’s work is designed to counter those threats, both by improvements to current technological capabilities and development of new, revolutionary technological capabilities. The Information Analysis and Infrastructure Protection Directorate is responsible for helping to deter, prevent, and mitigate acts of terrorism by assessing vulnerabilities in the context of continuously changing threats. It strengthens the nation’s protective posture and disseminates timely and accurate information to federal, state, local, private, and international partners. The Emergency Preparedness and Response Directorate is responsible for the National Incident Management System, which establishes standardized incident management processes, protocols, and procedures that all responders—federal, state, local and tribal—will use to coordinate and conduct response actions. The Department of Defense, while primarily responsible for the health and protection of its service members, contributes to global disease surveillance, training, research, and response to emerging infectious disease threats. The Defense Threat Reduction Agency provides technical expertise and capabilities in combat support, technology development, threat control and threat reduction, including chemical and biological defense. The United States Army Medical Research Institute of Infectious Diseases conducts biological research dealing with militarily relevant infectious diseases and biological agents. It also provides professional expertise on issues related to technologies and other tools to support readiness for a bioterrorist incident. The Department of Energy is developing new capabilities to counter chemical and biological threats. It expects the results of its research to be public and possibly lead to the development of commercial products in the domestic market. The Chemical and Biological National Security Program has conducted research on biological detection, modeling and prediction, and biological foundations to support efforts in advanced detection, attribution, and medical countermeasures. The national research laboratories (e.g., Lawrence Livermore, Los Alamos, and Sandia) are developing new capabilities for countering chemical and biological threats, including biological detection, modeling, and prediction. The Department of Agriculture (USDA) is responsible for protecting and improving the health and marketability of animals and animal products in the United States by preventing, controlling, and eliminating animal diseases. USDA’s disease surveillance and response activities are intended to protect U.S. livestock and ensure the safety of international trade. In addition, USDA is responsible for ensuring that meat, poultry, and certain processed egg products are safe and properly labeled and packaged. USDA establishes quality standards and conducts inspections of processing facilities in order to safeguard certain animal food products against infectious diseases that pose a risk to humans. The Agricultural Research Service conducts research to improve onsite rapid detection of biological agents in animals, plants, and food and has improved its detection capability for diseases and toxins that could affect animals and humans. The Food Safety Inspection Service provides emergency preparedness for foodborne incidents, including bioterrorism. The Animal and Plant Health Inspection Service has a role in responding to biological agents that cause zoonotic diseases (i.e., diseases transmitted from animals to humans). It also has veterinary epidemiologists to trace the source of animal exposures to diseases. The Environmental Protection Agency (EPA) has responsibilities to prepare for and respond to emergencies, including those related to biological materials. EPA can be involved in detection of agents by environmental monitoring and sampling. It is also responsible for protecting the nation’s water supply from terrorist attack and for prevention and control of indoor air pollution. The Department of Veterans Affairs (VA) manages one of the nation’s largest health care systems and is the nation’s largest drug purchaser. The department purchases pharmaceuticals and medical supplies for the Strategic National Stockpile and the National Medical Response Team stockpile. The VA Emergency Preparedness Act of 2002 directed VA to establish at least four medical emergency preparedness centers to (1) carry out research and develop methods of detection, diagnosis, prevention, and treatment for biological and other public health and safety threats; (2) provide education, training, and advice to health care professionals inside and outside VA; and (3) provide laboratory and other assistance to local health care authorities in the event of a national emergency. The following are GAO’s comments on the Department of Health and Human Services letter dated June 3, 2005. 1. We agree with HHS that the cost benefits of a standards-based approach to public health systems are potentially considerable. However, as we have reported before, the Center for Information Technology Leadership acknowledges that their cost estimates are based on a number of assumptions and inhibited by limited data that are neither complete nor precise. 2. We agree with HHS that standards-based systems provide important benefits. In our May 2003 report, we made several recommendations regarding the establishment and use of standards that are highlighted in this report. We also state that to support the compatibility, interoperability, and security of federal agencies’ many planned and operational IT systems, the identification and implementation of data, communications, and security standards for health care delivery and public health are essential. 3. HHS states that our report does not mention a number of activities related to the Federal Health Architecture and the Consolidated Health Informatics initiative. We described the status of workgroup efforts specific to public health surveillance. In terms of the standards adopted by the Consolidated Health Informatics initiative, we presented the relevant standards in our table of industry standards used by the Public Health Information Network. We disagree with HHS that the paragraph needs to be revised. While the development of standards and policies is a key component of progress toward the implementation of a national health IT strategy, the development of a national strategy and corresponding federal architecture is equally important. 4. We disagree with HHS that we should delete our discussion of the concerns of state and local public health officials regarding duplication of effort across federal agencies. Neither we nor the state and local public health officials suggest that early event detection at the federal level is irrelevant. Rather, we are reporting the concerns of state and local public health officials regarding the federal government’s role, which merits further discussion and more involvement of state and local health officials. 5. We have adjusted our report to indicate that fiscal year 2006 costs for BioSense are unknown. 6. HHS comments that not moving forward with its technology initiatives presents greater risk than waiting for a completed national health IT strategy. We are not suggesting that HHS stop its ongoing activities; we only point out the risks associated with developing and implementing major IT initiatives without a coordinated strategy in place. The following is GAO’s comment on the Department of Homeland Security’s letter dated June 3, 2005. 1. We disagree with DHS’s statement that we erroneously categorize its initiatives as still in the early states. The initiatives that we are referring to as being in the early stages are the Biological Warning and Incident Characterization System and the National Biosurveillance Integration System, which according to DHS officials are considered their two major IT initiatives. DHS categorized them as being in development. In addition to those named above, Barbara S. Collier, Neil J. Doherty, Amanda C. Gill, M. Saad Khan, Gay Hee Lee, Mary Beth McClanahan, M. Yvonne Sanchez, and Morgan Walts made key contributions to this report. Health Information Technology: HHS Is Taking Steps to Develop a National Strategy. GAO-05-628. Washington, D.C.: May 27, 2005. Health and Human Services’ Estimate of Health Care Cost Savings Resulting from the Use of Information Technology. GAO-05-309R. Washington, D.C.: February 17, 2005. HHS’s Efforts to Promote Health Information Technology and Legal Barriers to its Adoption. GAO-04-991R. Washington, D.C.: August 13, 2004. Health Care: National Strategy Needed to Accelerate the Implementation of Information Technology. GAO-04-947T. Washington, D.C.: July 14, 2004. Information Technology: Benefits Realized for Selected Health Care Functions. GAO-04-224. Washington, D.C.: October 31, 2003. Bioterrorism: Information Technology Strategy Could Strengthen Federal Agencies’ Abilities to Respond to Public Health Emergencies. GAO-03-139. Washington, D.C.: May 30, 2003. Automated Medical Records: Leadership Needed to Expedite Standards Development. GAO/IMTEC-93-17. Washington, D.C.: April 30, 1993.

Summary: It has been almost 4 years since the anthrax events of October 2001 highlighted the weaknesses in our nation's public health infrastructure. Since that time, emerging infectious diseases have appeared--such as Severe Acute Respiratory Syndrome and human monkeypox--that have made our readiness for public health emergencies even more critical. Information technology (IT) is central to strengthening the public health infrastructure through the implementation of systems to aid in the detection, preparation for, and response to bioterrorism and other public health emergencies. Congress asked us to review the current status of major federal IT initiatives aimed at strengthening the ability of government at all levels to respond to public health emergencies. Specifically, our objectives were to assess the progress of major federal IT initiatives designed to strengthen the effectiveness of the public health infrastructure and describe the key IT challenges facing federal agencies responsible for improving the public health infrastructure. Federal agencies have made progress on major public health IT initiatives, although significant work remains to be done. These initiatives include one broad initiative at CDC--the Public Health Information Network (PHIN) initiative--which is intended to provide the nation with integrated public health information systems to counter national civilian public health threats, and two major initiatives at the Department of Homeland Security (DHS), which are primarily focused on biosurveillance. CDC's broad PHIN initiative encompasses a number of applications and initiatives, which show varied progress. Currently, PHIN's basic communications systems are in place, but it is unclear when its surveillance systems and data exchange applications will become fully deployed. Further, the overall implementation of PHIN does not yet provide the desired functionality, and so some applications are not widely used by state and local public health officials. For example, CDC's BioSense application, which is aimed at detecting early signs of disease outbreaks, is available to state and local public health agencies, but according to the state and local officials with whom we spoke, it is not widely used, primarily because of limitations in the data it currently collects. DHS is also pursuing two major public health IT initiatives--the National Biosurveillance Integration System and the Biological Warning and Incident Characterization System (BWICS). Both of these initiatives are still in development. The BWICS initiative, in addition, is associated with three other programs, one of which--BioWatch--is operational. This early- warning environmental monitoring system was developed for detecting trace amounts of biological materials and has been deployed in over 30 locations across the United States. Until recently, its three IT components were not interoperable and required redundant data entry in order to communicate with each other. As federal agencies work with state and local public health agencies to improve the public health infrastructure, they face several challenges. First, the national health IT strategy and federal health architecture are still being developed; CDC and DHS will face challenges in integrating their public health IT initiatives into these ongoing efforts. Second, although federal efforts continue to promote the adoption of data standards, developing such standards and then implementing them are challenges for the health care community. Third, these initiatives involve the need to coordinate among federal, state, and local public health agencies, but establishing effective coordination among the large number of disparate agencies is a major undertaking. Finally, CDC and DHS face challenges in addressing specific weaknesses in IT planning and management that may hinder progress in developing and deploying public health IT initiatives. Until all these challenges are addressed, progress toward building a stronger public health infrastructure will be impeded, as will the ability to share essential information concerning public health emergencies and bioterrorism.