Recognizing the potential value of IT for public and private health systems, the federal government has, for several years, been working to promote the nationwide use of health IT. In April 2004, President Bush called for widespread adoption of interoperable electronic health records within 10 years and issued an executive order that established the position of the National Coordinator for Health IT within HHS. The National Coordinator’s responsibilities include developing, maintaining, and directing the implementation of a strategic plan to guide the nationwide implementation of interoperable health IT in both the public and private sectors. According to the strategic plan, the National Coordinator is to lead efforts to build a national health IT infrastructure that is intended to, among other things, ensure that patients’ individually identifiable health information is secure, protected, and available to the patient to be used for medical and nonmedical purposes, as directed by the patient and as appropriate. In January 2007, we reported on the steps that HHS was taking to ensure the protection of personal health information exchanged within a nationwide network and on the challenges facing health information exchange organizations in protecting electronic personal health information. We reported that although HHS and the Office of the National Coordinator had initiated actions to identify solutions for protecting electronic personal health information, the department was in the early stages of its efforts and had not yet defined an overall privacy approach. As described earlier, we made recommendations regarding the need for an overall privacy approach, which we reiterated in subsequent testimonies in February 2007, June 2007, and February 2008. In our report, we described applicable provisions of HIPAA and other federal laws that are intended to protect the privacy of certain health information, along with the HIPAA Privacy Rule and key principles that are reflected in the rule. Table 1 summarizes these principles. We also described in our report and testimonies challenges associated with protecting electronic health information that are faced by federal and state health information exchange organizations and health care providers. These challenges are summarized in table 2. We reported that HHS had undertaken several initiatives intended to address aspects of key principles and challenges for protecting the privacy of health information. For example, in 2005, the department awarded four health IT contracts that included requirements for developing solutions to comply with federal privacy requirements and identifying techniques and standards for securing health information. Since January 2007, HHS has undertaken various initiatives that are contributing to its development of an overall privacy approach, although more work remains. We recommended that this overall approach include (1) identifying milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, (2) ensuring that key privacy principles in HIPAA are fully addressed, and (3) addressing key challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of our recommendation, and it has taken important steps in addressing the two other parts. Nevertheless, these steps have fallen short of fully implementing our recommendation because they do not include a process for ensuring that all key privacy principles and challenges will be fully and adequately addressed. In the absence of such a process, HHS may not be effectively positioned to ensure that health IT initiatives achieve comprehensive privacy protection within a nationwide health information network. The department and its Office of the National Coordinator have continued taking steps intended to address key privacy principles and challenges through various health IT initiatives. Among other things, these initiatives have resulted in technical requirements, standards, and certification criteria related to the key privacy principles described in table 1. The following are examples of ways that the Office of the National Coordinator’s health IT initiatives relate to privacy principles reflected in HIPAA. As part of its efforts to advance health IT, the American Health Information Community defines “use cases,” which are descriptions of specific business processes and ways that systems should interact with users and with other systems to achieve specific goals. Among other things, several of the use cases include requirements and specifications that address aspects of the access, uses and disclosures, and amendments privacy principles. For example, the “consumer empowerment” use case describes at a high level specific capabilities that align with the access principle. It requires that health IT systems include mechanisms that allow consumers to access their own clinical information, such as lab results and diagnosis codes, from other sources to include in their personal health records. The use case also aligns with the uses and disclosures principle and includes requirements that allow consumers to control access to their personal health record information and specify which information can be accessed by health care providers and organizations within health information networks. Further, the consumer empowerment use case aligns with the amendments privacy principle, emphasizing the need for policies to guide decisions about which data consumers should be able to modify, annotate, or request that organizations change. (Other use cases that are related to these privacy principles are the “personalized healthcare” and “remote monitoring” use cases.) Under HHS’s initiative to implement a nationwide health information network, in January 2007, four test network implementations, or prototypes, demonstrated potential nationwide health information exchange and laid the foundation for the Office of the National Coordinator’s ongoing network trial implementations. Activities within the prototypes and the trial implementations are related to privacy principles, including the security, access, uses and disclosures, and administrative requirements principles. For example, the prototypes produced specific requirements for security mechanisms (such as data access control and encryption) that address aspects of the security principle. Additionally, the ongoing trial implementations are guided by requirements for using personal health data intended to address the access, uses and disclosures, and administrative requirements principles. For example, participants in the trial implementations are to provide the capability for consumers to access information, such as registration and medication history data, from other sources to include in their personal health records, to control access to self-entered data or clinical information held in a personal health record, and to control the types of information that can be released from personal health records for health information exchange. In addition, organizations participating in the network are required to provide system administrators the ability to monitor and audit all access to and use of the data stored in their systems. The Healthcare Information Technology Standards Panel continued work to “harmonize” standards directly related to several key privacy principles, primarily the security principle. In addition, the panel developed technical guidelines that are intended to address other privacy principles, such as the authorization principle and the uses and disclosures principle. For example, the panel’s guidelines specify that systems should be designed to ensure that consumers’ instructions related to authorization and consent are captured, managed, and available to those requesting the health information. The Certification Commission for Healthcare Information Technology, which is developing and evaluating the criteria and process for certifying the functionality, security, and interoperability of electronic health records, took steps that primarily address the security principle. For example, the commission defined specific security criteria for both ambulatory and inpatient electronic health records that require various safeguards to be in place before electronic health record systems are certified. Among other things, these safeguards include ensuring that system administrators can modify the privileges of users so that only those who have a need to access patients’ information are allowed to do so and that the minimum amount of information necessary can be accessed by system users. The State-Level Health Information Exchange Consensus Project, a consortium of public and private-sector stakeholders, is intended to promote consistent organizational policies regarding privacy and health information exchange. The consortium issued a report in February 2007 that addresses, among other principles, the uses and disclosures privacy principle. For example, the report advises health information exchange organizations to maintain information about access to and disclosure of patients’ personal health information and to make that data available to patients. The consortium subsequently issued another report in March 2008 that recommended practices to ensure the appropriate access, use, and control of health information. Additionally, two of HHS’s key advisory groups continued to develop and provide recommendations to the Secretary of HHS for addressing privacy issues and concerns: The Confidentiality, Privacy, and Security Workgroup was formed in 2006 by the American Health Information Community to focus specifically on these issues and has submitted recommendations to the community that address privacy principles. Among these are recommendations related to the notice principle that the workgroup submitted in February and April 2008. These recommendations stated that health information exchange organizations should provide patients, via the Web or another means, information in plain language on how these organizations use and disclose health information, their privacy policies and practices, and how they safeguard patient or consumer information. The work group also submitted recommendations related to the administrative requirements principle, stating that the obligation to provide individual rights and a notice of privacy practices under HIPAA should remain with the health care provider or plan that has an established, independent relationship with a patient, not with the health information exchange. The National Committee on Vital and Health Statistics, established in 1949, advises the Secretary of HHS on issues including the implementation of health IT standards and safeguards for protecting the privacy of personal health information. The committee’s recent recommendations related to HHS’s health IT initiatives addressed, among others, the uses and disclosures principle. For example, in February 2008, the National Committee submitted five recommendations to the Secretary that support an individual’s right to control the disclosure of certain sensitive health information for the purposes of treatment. Although the recommendations from these two advisory groups are still under consideration by the Secretary, according to HHS officials, contracts for the nationwide health information network require participants to consider these recommendations when conducting network trials once they are accepted by the Secretary. The Office of the National Coordinator also took actions intended to address key challenges to protecting exchanges of personal electronic health information. Specifically, state-level initiatives (described below) were formed to bring stakeholders from states together to collaborate, propose solutions, and make recommendations to state and federal policymakers for addressing challenges to protecting the privacy of electronic personal health information within a nationwide health information exchange. Outcomes of these initiatives provided specific state-based solutions and recommendations for federal policy and guidance for addressing key challenges described by our prior work (see table 2).