Approaches to electronic health information exchange have expanded in recent years with the increased adoption of EHRs and growth of HIE organizations. For example, some providers can electronically exchange clinical information via interoperable EHR systems. In cases in which providers wish to exchange electronic health information but do not have interoperable systems, HIE organizations can serve as key facilitators of exchange by providing for data connections among stakeholders, including laboratories, public health departments, hospitals, and physicians. Specifically, the use of EHR technology and the use of HIE organizations can allow providers to request and receive information about patients from other providers’ records, such as medication lists, laboratory results, or previous diagnoses and hospitalizations. For example, when a provider requests information, the HIE organization may be able to identify the sources of the requested data and initiate the electronic transmission that delivers the data from another provider’s EHR in a format that can be accepted and processed by the receiving provider’s EHR. Examples of exchange activities that can occur using EHR technology directly between providers or through an HIE organization are shown in figure 1. According to an April 2012 article, exchanging EHR information with other entities can be significantly more difficult for a provider than using EHRs to manage health information within the provider’s organization only— without exchanging the information with others. Appendix I provides information about the extent to which providers are able to electronically exchange health information, as reported by providers and stakeholders we interviewed. HITECH provided funding for various activities, including the Medicare and Medicaid EHR programs. These programs are intended to help increase the meaningful use of EHR technology by providing incentive payments for, and later imposing penalties on, providers—that is, certain hospitals and health care professionals such as physicians—who participate in Medicare or Medicaid. These programs are the largest of the activities, in terms of potential federal expenditures, funded by HITECH. Within HHS, CMS and ONC have developed the programs’ requirements. As the programs progress through these stages, Stage 1, which began in 2011, set the basic functionalities EHRs must include, such as capturing data electronically and providing patients with electronic copies of health information. CMS and ONC indicated that Stage 1 allowed providers to test the capability of their EHRs to electronically exchange health information. Stage 2, which began in 2014, added requirements such as increased health information exchange between providers to improve care coordination for patients. For example, Stage 2 will require hospitals and professionals to provide an electronic summary of care document for each transition of care or referral to another provider, whereas in Stage 1 this measure was optional. Stage 3, which is scheduled to go into effect in 2017, will continue to expand on meaningful use to improve health care outcomes and the exchange of health information, according to CMS and ONC. The requirements for this stage have not yet been developed. ONC is responsible for identifying health data standards and technical specifications for EHR technology and establishing and overseeing the certification of EHR technology. As part of the EHR programs, providers must report annually on certain mandatory meaningful use measures and on additional measures that they may choose from a menu of measures. Appendix II describes those Stage 1 and Stage 2 meaningful use measures that CMS and ONC reported as specifically relating to health information exchange. Providers and stakeholders we interviewed cited key challenges to electronic health information exchange; in particular, they cited issues related to insufficient standards, concerns about how privacy rules can vary among states, difficulties in matching patients to their records, and costs associated with electronic health information exchange. CMS and ONC officials noted that they have several ongoing programs and initiatives to help address some aspects of these key challenges, but concerns in these areas continue to exist. Reported insufficiencies in standards for electronic health information exchange. While standards for electronically exchanging information within the EHR programs exist, providers reported that standards may not be sufficient in some areas. Information that is electronically exchanged from one provider to another must adhere to the same standards in order to be interpreted and used in EHRs, thereby permitting interoperability. Several providers stated that they often have difficulty exchanging certain types of health information with other providers that have a different EHR system due to a lack of sufficient standards to support exchange. One area for which providers told us standards were insufficient relates to standards for allergies. Specifically, one provider noted that there are not sufficient standards to define allergic reactions, and another provider explained that some EHR systems classify an allergic reaction as a side effect, while other EHR systems classify the same reaction as an allergy. Such differences can cause confusion when health information is exchanged among providers because providers who receive information may have difficulty locating or using information on allergies if their EHR systems classify the information differently than the EHR systems of the providers who sent the information. Similarly, an article from the Journal of the American Medical Informatics Association stated that the proper terminology for encoding patients’ allergies is complex and that some gaps still exist across existing standards. Providers who participated in the EHR programs from fiscal year 2011 through fiscal year 2013 could use certified EHR technology that conformed to the 2011 edition of the standards and certification criteria. All providers that participate in the EHR Programs in fiscal year 2014 must conform to the 2014 edition of the standards and certification criteria. ONC is expected to develop another set of standards and certification criteria that certified EHR technology would be required to conform to beginning in 2016. from one entity to another. HHS expects that providers using the 2014 edition will have greater ability to exchange information. Patient encounters are commonly recorded in free-form text narratives, or as unstructured clinical data. While free-form patient narratives give the provider flexibility to note observations that are not supported by structured data, they are not easily searchable and aggregated and can be more difficult to analyze. that RxNorm and the Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT) should be expanded for nonmedication allergies and allergic reactions. Fifth, several providers and stakeholders commented that the Direct Protocol allows for limited exchange, such as exchanging a secure email message, rather than enabling certain other functionalities, such as the ability to query another EHR system. Reported variation in state privacy rules and lack of clarity about requirements. Some providers noted that exchanging health information with providers in other states can be difficult due to their limited understanding of variations in privacy rules from state to state. Some providers also noted that exchange can be especially difficult in cases when providers are located close to state borders and therefore serve patients from another state. Providers that are covered by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 must adhere to federal privacy rules and can also be subject to state privacy rules. These state rules can be more stringent than HIPAA requirements or standards. HIPAA’s Administrative Simplification Provisions required the establishment of, among other things, national privacy standards. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 1936, 2021 (codified at 42 U.S.C. §§ 1320d–1320d-8). These provisions also expressly provided that such national standards would not preempt state laws that impose requirements, standards, or implementation specifications that are more stringent than those imposed under federal regulation. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 1936, 2021, see 42 U.S.C. §§ 1320d–2 notes. HIPAA regulates covered entities’ (including most health care providers’) use and disclosure of personal health information. The Privacy Rule generally permits the use or disclosure of an individual’s protected health information without the individual’s written authorization for purposes of treatment, payment and health care operations. Under the Privacy Rule, more stringent state laws that are not preempted by federal law include those that prohibit or restrict a use or disclosure in circumstances under which such use or disclosure would be permitted under HIPAA. See 45 C.F.R. 160.202. To address privacy issues related to electronic health information exchange, ONC officials have several ongoing efforts. For example, ONC has issued high-level guidance for providers on how to ensure the privacy and security of health information covering a wide range of topics related to meaningful use and the HIPAA Privacy and Security Rules, among other things. Regarding state privacy laws, this guidance suggests that providers seek information from state agencies, RECs, and professional associations to understand how state laws affect the sharing of patient health information. In addition, ONC began the Data Segmentation for Privacy Initiative to develop and pilot test standards for managing patient consents and data segmentation. As part of this initiative, ONC released an implementation guide for consent management and data segmentation in the summer of 2012, and the agency is currently pilot testing this guide. In addition, ONC’s state HIE organization program is currently receiving reports from states on how they are implementing their state’s privacy rules. Officials expect to receive the information from states by March 2014. ONC officials are hopeful that these efforts will help address privacy concerns and, as a result, facilitate exchange efforts for providers. Although ONC is working on privacy issues, some providers we spoke with reported that lack of clarity in state privacy laws is one reason that they have experienced difficulty exchanging health information with providers in other states. They found it difficult to ensure they were compliant with state laws when exchanging certain personal health information with providers in another state. For example, some providers in Minnesota and Massachusetts noted that some state laws have stringent requirements related to sharing health information related to mental health, or human immunodeficiency virus or other sexually transmitted infections. In addition, some providers told us that different providers in their state have different interpretations regarding how frequently they must obtain consent from the patient, as required under the state privacy rule, for the exchange of patients’ health information.