Health Information Technology
HHS is Continuing Efforts to Define Its National Strategy Gao ID: GAO-06-1071T September 1, 2006As GAO and others have reported, the use of information technology (IT) has enormous potential to improve the quality of health care and is critical to improving the performance of the U.S. health care system. Given the federal government's role in providing health care in the U.S., it has been urged to take a leadership role in driving change to improve the quality and effectiveness of health care, including the adoption of IT. In April 2004, President Bush called for widespread adoption of interoperable electronic health records within 10 years and issued an executive order that established the position of the National Coordinator for Health Information Technology. A National Coordinator within the Department of Health and Human Services (HHS) was appointed in May 2004 and released a framework for strategic action two months later. In May 2005, GAO recommended that HHS establish detailed plans and milestones for each phase of the framework and take steps to ensure that its plans are followed and milestones are met. GAO was asked to identify progress made by HHS toward the development and implementation of a national health IT strategy. To do this, GAO reviewed prior reports and agency documents on the current status of relevant HHS activities.
In late 2005, to help define the future direction of a national strategy, HHS awarded several health IT contracts and formed the American Health Information Community, a federal advisory committee made up of health care stakeholders from both the public and private sectors. Through the work of these contracts and the community, HHS and its Office of the National Coordinator for Health IT have made progress in five major areas associated with the President's goal of nationwide implementation of health IT. These activities and others are being used by the Office of the National Coordinator for Health IT to continue its efforts to complete a national strategy to guide the nationwide implementation of interoperable health IT. Since the release of its initial framework in 2004, the office has defined objectives and high-level strategies for accomplishing its goals. Although HHS agreed with GAO's prior recommendations and has made progress in these areas, it still lacks detailed plans, milestones, and performance measures for meeting the President's goals.
GAO-06-1071T, Health Information Technology: HHS is Continuing Efforts to Define Its National Strategy
This is the accessible text file for GAO report number GAO-06-1071T
entitled 'Health Information Technology: HHS is Continuing Efforts to
Define It's National Strategy' which was released on September 1, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony:
Before the Subcommittee on Federal Workforce and Agency Organization,
Committee on Government Reform, House of Representatives:
For Release on Delivery:
Expected at 1:00 p.m. CDT Friday, September 1, 2006:
Health Information Technology:
HHS is Continuing Efforts to Define Its National Strategy:
Statement of David A. Powner:
Director, Information Technology Management Issues:
GAO-06-1071T:
GAO Highlights:
Highlights of GAO-06-1071T, a testimony before the Subcommittee on
Federal Workforce and Agency Organization, Committee on Government
Reform, House of Representatives
Why GAO Did This Study:
As GAO and others have reported, the use of information technology (IT)
has enormous potential to improve the quality of health care and is
critical to improving the performance of the U.S. health care system.
Given the federal government‘s role in providing health care in the
U.S., it has been urged to take a leadership role in driving change to
improve the quality and effectiveness of health care, including the
adoption of IT. In April 2004, President Bush called for widespread
adoption of interoperable electronic health records within 10 years and
issued an executive order that established the position of the National
Coordinator for Health Information Technology. A National Coordinator
within the Department of Health and Human Services (HHS) was appointed
in May 2004 and released a framework for strategic action two months
later. In May 2005, GAO recommended that HHS establish detailed plans
and milestones for each phase of the framework and take steps to ensure
that its plans are followed and milestones are met.
GAO was asked to identify progress made by HHS toward the development
and implementation of a national health IT strategy. To do this, GAO
reviewed prior reports and agency documents on the current status of
relevant HHS activities.
What GAO Found:
In late 2005, to help define the future direction of a national
strategy, HHS awarded several health IT contracts and formed the
American Health Information Community, a federal advisory committee
made up of health care stakeholders from both the public and private
sectors. Through the work of the these contracts and the community, HHS
and its Office of the National Coordinator for Health IT have made
progress in five major areas associated with the President‘s goal of
nationwide implementation of health IT (see table).
Table: Five Areas of Progress and Supporting Activities:
Areas of Progress: Advancing use of electronic health records;
Activities:
* Defined initial certification criteria for certain electronic health
records and certified 22 vendors‘ products;
* Presented functional requirements for inclusion of patient
information into electronic health records;
* Initiated work to advance the use of electronic health records to
rebuild medical records following disasters.
Areas of Progress: Establishing interoperability standards for a health
information exchange; Activities:
* American National Standards Institute Health IT Standards Panel
selected 90 interoperability standards for areas such as electronic
health records and public health detection and reporting;
* Coordinated with the National Institute for Standards and Technology
to align federal and private sector standards for interoperable health
IT.
Areas of Progress: Developing prototypes of a nationwide health
information network; Activities:
* Awarded contracts for developing prototypes for a national network to
four contractors;
* Proposed more than 1000 functional requirements;
* Held the first nationwide health information forum.
Areas of Progress: Addressing privacy and security issues associated
with the nationwide exchange of health information; Activities:
* Contracted with 34 states and territories to perform assessments of
the impact of policies and laws on security and privacy practices;
* Selected standards to help ensure privacy and confidentiality;
* Formed a new workgroup to specifically address privacy and security
policy issues;
* Made recommendations covering topics that are central to challenges
for protecting health information privacy in a national health
information exchange environment.
Areas of Progress: Integrating public health systems into a national
network; Activities:
* Made recommendations to help support sharing of clinical care data
with local, state, and federal biosurveillance programs, including the
development of materials for public education on benefits to public
health and national security, and the protection of patient
confidentiality;
* Selected information exchange standards for sharing clinical health
information with public health.
Source: GAO analysis of HHS data.
[End of Table]
These activities and others are being used by the Office of the
National Coordinator for Health IT to continue its efforts to complete
a national strategy to guide the nationwide implementation of
interoperable health IT. Since the release of its initial framework in
2004, the office has defined objectives and high-level strategies for
accomplishing its goals. Although HHS agreed with GAO‘s prior
recommendations and has made progress in these areas, it still lacks
detailed plans, milestones, and performance measures for meeting the
President‘s goals.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-1071T].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact David A. Powner at
(202)512-9286 or pownerd@gao.gov.
[End of Section]
Mr. Chairman and Members of the Subcommittee:
I am pleased to be here today to comment on federal efforts to advance
the use of information technology (IT) for health care delivery and
public health. As we and others have reported, the use of IT has
enormous potential to improve the quality of health care and is
critical to improving the performance of the U.S. health care system.
Recognizing the potential value of IT in public and private health care
systems, the federal government has been working to promote the
nationwide use of health IT.[Footnote 1] In April 2004, President Bush
called for widespread adoption of interoperable electronic health
records within 10 years and issued an executive order[Footnote 2] that
established the position of the National Coordinator for Health
Information Technology within the Department of Health and Human
Services (HHS). The National Coordinator's responsibilities include the
development and implementation of a strategic plan to guide the
nationwide implementation of interoperable health IT in both the public
and private sectors.
At your request, today we will discuss progress made by HHS and its
Office of the National Coordinator for Health IT toward the development
and implementation of a national health IT strategy. In preparing this
statement, we reviewed agency documents on the current status of HHS's
activities related to a national health IT strategy and supplemented
our analysis with interviews of agency officials. We also summarized
prior GAO reports. Our work was performed in accordance with generally
accepted auditing standards.
Results in Brief:
HHS and its Office of the National Coordinator for Health IT have made
progress through the work of the American Health Information
Community[Footnote 3] and several recently-awarded contracts[Footnote
4] in five major areas: (1) defining certification criteria for and
certifying electronic health records, (2) identifying interoperability
standards to facilitate the exchange of patient data, (3) defining
requirements for the development of prototypes for the Nationwide
Health Information Network, (4) addressing privacy and security issues
associated with the nationwide exchange of health information, and (5)
taking steps to integrate public health into a nationwide health
information exchange. Specifically, certification criteria for
ambulatory electronic health records[Footnote 5] have been defined and
22 electronic health records vendors have achieved certification for
their products. Additionally, 90 interoperability standards have been
selected for areas such as electronic health records and public health
detection and reporting, and functional requirements for a nationwide
health information network have been proposed. The American Health
Information Community has also formed a workgroup to specifically
address confidentiality and security issues relevant to a nationwide
health information exchange.
These activities and others are being used by the Office of the
National Coordinator for Health IT to continue its efforts to complete
a national strategy to guide the nationwide implementation of
interoperable health IT. Since the release of its initial framework in
2004, the office has defined objectives and high-level strategies for
accomplishing its goals. However, while HHS has made progress in these
areas, it still lacks detailed plans, milestones, and performance
measures for meeting the President's goals.
Background:
Studies published by the Institute of Medicine and others have
indicated that fragmented, disorganized, and inaccessible clinical
information adversely affects the quality of health care and
compromises patient safety. In addition, long-standing problems with
medical errors and inefficiencies increase costs for health care
delivery in the United States. With health care spending in 2004
reaching almost $1.9 trillion, or 16 percent, of the gross domestic
product, concerns about the costs of health care continue. As we
reported last year, many policy makers, industry experts, and medical
practitioners contend that the U.S. health care system is in a
crisis.[Footnote 6]
Health IT provides a promising solution to help improve patient safety
and reduce inefficiencies. The expanded use of health IT has great
potential to improve the quality of care, bolster the preparedness of
our public health infrastructure, and save money on administrative
costs. As we reported in 2003, technologies such as electronic health
records and bar coding of certain human drug and biological product
labels have been shown to save money and reduce medical
errors.[Footnote 7] For example, a 1,951-bed teaching hospital reported
that it realized about $8.6 million in annual savings by replacing
outpatient paper medical charts with electronic medical records. This
hospital also reported saving more than $2.8 million annually by
replacing its manual process for managing medical records with an
electronic process to provide access to laboratory results and reports.
Health care organizations also reported that IT contributed other
benefits, such as shorter hospital stays, faster communication of test
results, improved management of chronic diseases, and improved accuracy
in capturing charges associated with diagnostic and procedure codes.
However, according to HHS, only a small number of U.S. health care
providers have fully adopted health IT due to significant financial,
technical, cultural, and legal barriers such as a lack of access to
capital, a lack of data standards, and resistance from health care
providers.
Federal Government's Role in Health Care:
According to the Institute of Medicine, the federal government has a
central role in shaping nearly all aspects of the health care industry
as a regulator, purchaser, health care provider, and sponsor of
research, education, and training. Seven major federal health care
programs, such as Medicare and Medicaid, provide health care services
to approximately 115 million Americans. According to HHS, federal
agencies fund more than a third of the nation's total health care
costs. Table 1 summarizes the programs and number of citizens who
receive health care services from the federal government and the cost
of these services.
Table 1: Beneficiaries and Expenditures in Major Federal Health Care
Programs for Fiscal Year 2004:
Federal agency: HHS;
Program: Medicare;
Beneficiaries: 42 million elderly and disabled beneficiaries;
Expenditure: (in billions): $309.
Federal agency: HHS;
Program: Medicaid;
Beneficiaries: 43.7 million low-income persons;
Expenditure: (in billions): 276.8; (joint federal and state).
Federal agency: HHS;
Program: State Children's Health Insurance Program;
Beneficiaries: 5.8 million children[A];
Expenditure: (in billions): 6.6; (joint federal and state).
Federal agency: HHS;
Program: Indian Health Service;
Beneficiaries: 1.8 million Native Americans and Alaska Natives;
Expenditure: (in billions): 3.7.
Federal agency: Veterans Affairs;
Program: Veterans Health Administration;
Beneficiaries: 5.2 million veterans;
Expenditure: (in billions): 26.8.
Federal agency: Department of Defense;
Program: Tricare Program;
Beneficiaries: 8.3 million active-duty military personnel and their
families, and military retirees;
Expenditure: (in billions): 30.4.
Federal agency: Office of Personnel Management;
Program: Federal Employees Health Benefit Program;
Beneficiaries: 8 million federal employees, retirees, and dependents;
Expenditure: (in billions): 27.
Source: HHS, VA, DOD, and OPM budget documents.
[A] Based on fiscal year 2003 data.
[End of table]
Given the level of the federal government's participation in providing
health care, it has been urged to take a leadership role in driving
change to improve the quality and effectiveness of medical care in the
United States, including an expanded adoption of IT.
In April 2004, President Bush called for the widespread adoption of
interoperable electronic health records within 10 years and issued an
executive order[Footnote 8] that established the position of the
National Coordinator for Health Information Technology within HHS. The
National Coordinator's responsibilities include the development and
implementation of a strategic plan to guide the nationwide
implementation of interoperable health IT in both the public and
private sectors. The first National Coordinator was appointed in May
2004,[Footnote 9] and two months later HHS released The Decade of
Health Information Technology: Delivering Consumer-centric and
Information-rich Health Care--Framework for Strategic Action, the first
step toward the development of a national strategy. The framework
described goals for achieving nationwide interoperability of health IT
and actions to be taken by both the public and private sectors to
implement a strategy. Just last week, President Bush issued an
executive order calling for federal health care programs and their
providers, plans, and insurers to use IT interoperability standards
recognized by HHS.[Footnote 10]
Need for a National Strategy and Greater Interoperability:
In the summer of 2004, we testified on the benefits that effective
implementation of IT can bring to the health care industry and the need
for HHS to provide continued leadership, clear direction, and
mechanisms to monitor progress in order to bring about measurable
improvements.[Footnote 11] Last year, we reported that HHS, through the
Office of the National Coordinator for Health IT, had taken a number of
actions toward accelerating the use of IT to transform the health care
industry. To further accelerate the adoption of interoperable health
information systems, we recommended that HHS establish detailed plans
and milestones for meeting the goals of its framework for strategic
action and take steps to ensure that those plans are followed and
milestones are met.[Footnote 12] The department agreed with our
recommendation.
We also reported in June 2005 that challenges associated with major
public health IT initiatives still need to be overcome to strengthen
the IT that supports the public health infrastructure.[Footnote 13]
Federal agencies face many challenges in their efforts to improve the
public health infrastructure, including (1) the integration of current
initiatives into a national health IT strategy and federal architecture
to reduce the risk of duplicative efforts, (2) development and adoption
of consistent standards to encourage interoperability, (3) coordination
of initiatives with state and local agencies to improve the public
health infrastructure, and (4) overcoming federal IT management
weaknesses to improve progress on IT initiatives. To address these
challenges, we recommended that HHS align federal public health
initiatives with the national health IT strategy and federal health
architecture, coordinate with state and local public health agencies,
and continue federal actions to encourage the development and adoption
of data standards.
Last September, we testified about the importance of defining and
implementing data and communication standards to speed the adoption of
interoperable IT in the health care industry.[Footnote 14] Hurricane
Katrina highlighted the need for interoperable electronic health
records as thousands of people were separated from their health care
providers and their paper medical records were lost. As we have noted,
standards are critical to enabling this interoperability. Although
federal leadership has been established to accelerate the use of IT in
health care, we testified that several actions[Footnote 15] were still
needed to position HHS to further define and implement relevant
standards. Otherwise, the health care industry will continue to be
plagued with incompatible systems that are incapable of exchanging
medical information that is critical to delivering care and responding
to public health emergencies.
In March 2006, we testified before this subcommittee[Footnote 16] on
HHS's continued efforts to move forward with its mission to guide the
nationwide implementation of interoperable health IT in the public and
private health care sectors. We identified several steps taken by the
department, such as the establishment of the organizational structure
and management team for the Office of the National Coordinator for
Health IT under the Office of the Secretary and the formation of a
public-private advisory body--the American Health Information
Community--to advise HHS on achieving interoperability for health
information exchange. The community, which is co-chaired by the
Secretary of HHS and the former National Coordinator for Health IT,
identified four breakthrough areas[Footnote 17] --consumer empowerment,
chronic care, biosurveillance, and electronic health records--and
formed workgroups intended to make recommendations for actions in these
areas that will produce tangible results within a one- year period.
Subsequently, in May 2006 the workgroups presented 28 recommendations
to the American Health Information Community that address standards,
privacy and security, and data-sharing issues.
We also reported in March 2006[Footnote 18] that HHS--through the
Office of the National Coordinator for Health IT--awarded $42 million
in contracts that address a range of issues important for developing a
robust health IT infrastructure, such as an increasing number of health
care providers adopting electronic health records, definitions of
health information standards being developed, architectural definitions
for a national network, and the development and implementation of
privacy and security policies. HHS intends to use the results of the
contracts and recommendations from the American Health Information
Community proceedings to define the future direction of a national
strategy. In March, the National Coordinator told us that he intended
to release a strategic plan with detailed plans and milestones later
this year. The contracts are described in table 2.
Table 2: Table 2: Health IT Contracts Awarded by HHS's Office of the
National Coordinator:
Contract: American Health Information Community Program Support;
Date awarded: September 2005;
Duration: 1 year;
Cost: (in millions): $0.8;
Description: To provide assistance to the National Coordinator in
convening and managing the meetings and activities of the community to
ensure that the health IT plan is seamlessly coordinated.
Contract: Standards Harmonization Process for Health IT;
Date awarded: September 2005;
Duration: 1 year;
Cost: (in millions): 3.2;
Description: To develop and test a process for identifying, assessing,
endorsing, and maintaining a set of standards required for
interoperable health information exchange.
Contract: Compliance Certification Process for Health IT;
Date awarded: September 2005;
Duration: 1 year;
Cost: (in millions): 2.7;
Description: To develop and evaluate a compliance certification process
for health IT, including the infrastructure components through which
these systems interoperate.
Contract: Privacy and Security[A];
Date awarded: September 2005;
Duration: 1½; years;
Cost: (in millions): 17.5; (Increased by $6 million in August 2006 to
include additional studies);
Description: To assess and develop plans to address variations in
organization-level business policies and state laws that affect privacy
and security practices that may pose challenges to an interoperable
health information exchange.
Contract: Nationwide Health Information Network Prototypes;
Date awarded: November 2005;
Duration: 1 year;
Cost: (in millions): 18.6; (4 contracts);
Description: To develop and evaluate prototypes for a nationwide health
information network architecture to maximize the use of existing
resources such as the Internet to achieve widespread interoperability
among software applications, particularly electronic health records.
These contracts are also intended to spur technical innovation for
nationwide electronic sharing of health information in patient care and
public health settings.
Contract: Measuring the Adoption of Electronic Health Records;
Date awarded: September 2005;
Duration: 2 years;
Cost: (in millions): 1.8;
Description: To develop a methodology to better characterize and
measure the state of electronic health records adoption and determine
the effectiveness of policies aimed at accelerating adoption of
electronic health records and interoperability.
Contract: Gulf Coast Electronic Digital Health Recovery;
Date awarded: September 2005;
Duration: 1 year;
Cost: (in millions): 3.7;
Description: To plan and promote the widespread use of electronic
health records and digital health information recovery in the Gulf
Coast regions affected by hurricanes last year.
Source: HHS Office of the National Coordinator for Health Information
Technology.
[A] Jointly managed by the Agency for Healthcare Research and Quality
and the Office of the National Coordinator.
[End of table]
HHS Is Continuing Efforts to Advance the Nationwide Implementation of
Health IT and Complete a National Strategy:
HHS and its Office of the National Coordinator for Health IT have made
progress through the work of the American Health Information Community
and several contracts in five major areas: (1) advancing the use of
electronic health records, (2) establishing standards to facilitate the
exchange of patient data, (3) defining requirements for the development
of prototypes of the Nationwide Health Information Network, (4)
incorporating privacy and security policy, practices, and standards
into the national strategy, and (5) integrating public health into
nationwide health information exchange.
These activities and others are being used by the Office of the
National Coordinator for Health IT to continue its efforts to complete
a national strategy to guide the nationwide implementation of
interoperable health IT. Since the release of its initial framework in
2004, the office has taken additional steps to define a complete
national strategy, building on its earlier work. However, while HHS has
made progress in these areas, it still lacks detailed plans,
milestones, and performance measures for meeting the President's goals.
HHS Is Advancing the Use of Electronic Health Records:
HHS has made progress toward advancing the adoption of electronic
health records by defining initial certification criteria for
ambulatory electronic health records. The Certification Committee for
Health IT,[Footnote 19] which was awarded the Compliance Certification
Process for Health IT contract, finalized functionality, security, and
reliability certification criteria for ambulatory electronic health
records in May 2006 and described interoperability criteria for future
certification requirements. The committee subsequently certified 22
vendors' electronic health records products in July. Its next phase is
to define and recommend certification criteria for inpatient electronic
health records. The committee plans to publish these criteria for
public comment during the last quarter of 2006, with certification
beginning in the second quarter of 2007.
Additionally, the Nationwide Health Information Network contracts have
thus far resulted in the identification of draft functional
requirements for incorporating lab results and patient information,
such as medical history and insurance information, into electronic
health records. The requirements were presented to the Secretary of HHS
in June 2006, and an initial set of requirements for the Nationwide
Health Information Network are expected to be issued in September 2006.
In our March 2006 testimony, we described the Gulf Coast Electronic
Digital Health Recovery contract, which was awarded by HHS to promote
the use of electronic health records to rebuild medical records for
patients in the Gulf Coast region affected by hurricanes last year. The
outcomes of the contract are expected to coordinate planning for the
recovery of digital health information in cases of emergencies or
disasters and to develop a prototype of health information sharing and
electronic health records support. The contract established a task
force of local and national experts to help area providers turn to
electronic medical records as they rebuild medical records for their
patients.
HHS Has Initiated Steps to Establish Health IT Standards:
HHS awarded its Standards Harmonization Process for Health IT contract
to ANSI.[Footnote 20] The contract is supported by ANSI's Health IT
Standards Panel, a collaborative partnership between the public and
private sector. This effort integrates standards previously identified
by the Consolidated Health Informatics[Footnote 21] and other federal
initiatives. To date, the panel has selected 90 interoperability
standards for areas such as electronic health records and public health
detection and reporting. The selected standards specifically address
components of the breakthrough areas defined by the American Health
Information Community and were produced by accepted standards
organizations. The Nationwide Health Information Network functional
requirements also incorporate standards defined through the work of the
Standards Harmonization Process for Health IT contract. The selected
standards are currently being reviewed for acceptance by the Secretary.
HHS has also involved the Department of Commerce's National Institute
for Standards and Technology (NIST) with HHS's work to implement health
IT standards through its standards harmonization contract. HHS's
standards harmonization contractor is required to maximize the use of
existing processes and collaborate with NIST where appropriate,
including consideration of outputs from the standards harmonization
process as Federal Information Processing Standards[Footnote 22]
relevant to federal agencies. NIST's issuance of Federal Information
Processing Standards for health IT is to be aligned with
recommendations from public and private sector coordination efforts
through the American Health Information Community, as accepted by the
Secretary of HHS. The Federal Information Processing Standards are to
be consistent with the standards adopted by the harmonization contract
to enable the alignment of federal and private sector standards and
widespread interoperability among health IT systems, particularly
electronic health records systems.
HHS Has Begun to Define Requirements for the Development of Prototypes
for the Nationwide Health Information Network:
HHS's Nationwide Health Information Network contracts are intended to
provide architectures and prototypes of national networks based on the
breakthrough areas defined by the American Health Information
Community. HHS awarded contracts for developing these architectures and
prototypes to four contractors. The contractors are to deliver final
operating plans and prototypes of a national network that demonstrates
health information exchange across multiple markets in November 2006.
In late June 2006, HHS held its first Nationwide Health Information
Network forum. More than 1000 functional requirements for a Nationwide
Health Information Network were presented for discussion and public
input. The requirements addressed general Nationwide Health Information
Network infrastructure needs and the breakthrough areas defined by the
American Health Information Community. The requirements are being
reviewed by the National Committee for Vital and Health
Statistics,[Footnote 23] which is expected to release its approved
requirements by September 2006.
HHS Is Taking Steps to Incorporate Privacy and Security Policies,
Practices, and Standards into Its National Strategy:
HHS, through its contracts and recommendations from the American Health
Information Community and the National Committee for Vital and Health
Statistics, has initiated several actions to address privacy and
security issues associated with the nationwide exchange of health
information. In May 2006, 22 states subcontracted under HHS's privacy
and security contract to perform assessments of the impact of
organization-level business policies and state laws on security and
privacy practices and the degree to which they pose challenges to
interoperable health information exchange. In August 2006, 11 more
states and Puerto Rico were added to the scope of the contract. The
outcomes of the contract are to provide a nationwide synthesis of
information to inform privacy and security policy making at federal,
state, and local levels.
In addition, the standards selected through the standards harmonization
contract include those that are applicable to the consumer empowerment
breakthrough area, specifically privacy and confidentiality. Its
initial standards are intended to allow consumers the ability to
establish and manage permissions and access rights, along with informed
consent for authorized and secure exchange, viewing, and querying of
their medical information between designated caregivers and other
health professionals. Additionally, the proposed functional
requirements for the Nationwide Health Information Network include
security requirements that are needed for ensuring the privacy and
confidentiality of health information.
In May 2006, several of the American Health Information Community
workgroups recommended the formation of an additional workgroup
comprised of privacy, security, clinical, and technology experts from
each of the other American Health Information Community workgroups. The
Confidentiality, Privacy, and Security Workgroup was formed in July to
frame the privacy and security policy issues relevant to all
breakthrough areas and solicit broad public input to identify viable
options or processes to address these issues. The recommendations
developed by this workgroup are intended to establish an initial policy
framework and address issues including methods of patient
identification, methods of authentication, mechanisms to ensure data
integrity, methods for controlling access to personal health
information, policies for breaches of personal health information
confidentiality, guidelines and processes to determine appropriate
secondary uses of data, and a scope of work for a long-term independent
advisory body on privacy and security policies. The workgroup convened
last month.
In June 2006, the National Committee on Vital and Health Statistics
presented to the Secretary of HHS a report recommending actions
regarding privacy and confidentiality in the Nationwide Health
Information Network. The recommendations cover topics that are,
according to the committee, central to challenges for protecting health
information privacy in a national health information exchange
environment. Specifically, they address (1) the role of individuals in
making decisions about the use of their personal health information,
(2) policies for controlling disclosures across a national health
information network, (3) regulatory issues such as jurisdiction and
enforcement, (4) use of information by non-health care entities, and
(5) establishing and maintaining the public trust that is needed to
ensure the success of a national health information network. The
recommendations are being evaluated by the American Health Information
Community workgroups, the Certification Commission for Health IT,
Health Information Technology Standards Panel, and other HHS partners.
The committee intends to continue to update and refine its
recommendations as the architecture and requirements of the network
advance.
HHS Is Continuing to Address Public Health Integration:
To help promote the integration of public health data into a nationwide
health information exchange, the American Health Information
Community's biosurveillance workgroup made recommendations in May 2006
intended to help the simultaneous flow of clinical care data to and
among local, state, and federal biosurveillance programs. The community
recommended that HHS develop sample data-use agreements and
implementation guidance to facilitate the sharing of data from health
care providers to public health agencies. The workgroup also
recommended that HHS, in collaboration with privacy experts, state and
local governmental public health agencies, and clinical care partners,
develop materials to educate the public about the information that is
used for biosurveillance including the benefits to the public's health,
improved national security, and the protection of patient
confidentiality by September 30, 2006.
Information exchange standards for sharing clinical health information
(e.g., emergency department visit data and lab results) with public
health are included in the 90 standards recently recommended as a
result of HHS's standards harmonization contract. The standards are
intended to enable the transmission of essential ambulatory care and
emergency department visit, utilization, and lab result data from
electronic health care delivery and public health systems in
standardized and anonymized[Footnote 24] format to authorized public
health agencies within less than one day. In addition to advancing the
use of electronic health records, the Gulf Coast contract is intended
to help support public health emergency response by fostering the
availability of field-level electronic health records to clinicians
responding to disasters.
HHS Is Continuing Efforts to Complete and Implement a National Strategy
for Health IT:
As called for by the President's executive order in April 2004, the
national coordinator's office is continuing its efforts to complete a
national strategy for health IT. Since we testified in March 2006, the
office has worked to evolve the initial framework and, with guidance
from the American Health Information Community, has revised and refined
the goals and strategies identified in the initial framework. The new
draft framework--The Office of the National Coordinator: Goals,
Objectives, and Strategies--provides high-level strategies for meeting
the President's goal for the adoption of interoperable health IT and is
to be used to develop internal performance measures for the office's
activities.
The framework identifies objectives for accomplishing each of four
goals, along with 32 high-level strategies for meeting the objectives.
The Office of the National Coordinator has identified and prioritized
the 32 strategies for accomplishing the framework's goals and has
initiated 10 of them, which are supported by the contracts that HHS
awarded in fall 2005. Table 3 illustrates the framework's goals,
objectives, and strategies and identifies the 10 strategies that have
been initiated.
The Office of the National Coordinator has prioritized the remaining 22
strategies defined in its framework. Six strategies are under active
consideration, and the remaining 16 require future discussion.
According to officials with the office, the strategies were prioritized
based on guidance and direction from the American Health Information
Community. The Office of the National Coordinator expects the framework
to continue to evolve through collaboration among the Office of the
National Coordinator and its partners, such as other federal agencies
and the American Health Information Community, and as additional
activities are completed through the contracts.
Table 3: Office of the National Coordinator's Goals and Initial
Objectives and Strategies:
Goals: Goal 1: Inform health care professionals;
Objectives: High-value electronic health records;
High-level strategies: Simplify health information access and
communication among clinicians[A];
Increase incentives for clinicians to use electronic health records[C].
Goals: Goal 1: Inform health care professionals;
Objectives: Low-cost and low-risk electronic health records;
High-level strategies: Foster economic collaboration for electronic
health records adoption[B];
Lower total cost of electronic health records purchase and
implementation[B];
Lower risk of electronic health records adoption[A].
Goals: Goal 1: Inform health care professionals;
Objectives: Current clinical knowledge; High-level strategies: Increase
investment in sources of evidence-based knowledge[C];
Increase investment in tools that can access and integrate evidence
based knowledge in the clinical setting[C];
Establish mechanisms which will allow clinicians to empirically access
information and other patient characteristics that can better inform
their clinical decisions[C].
Goals: Goal 1: Inform health care professionals;
Objectives: Equitable adoption of electronic health records; High-level
strategies: Ensure low-cost electronic health records for clinicians in
underserved areas[C];
Support adoption and implementation by disadvantaged providers[C];
Goals: Goal 2: Interconnect health care;
Objectives: Widespread adoption of standards;
High-level strategies: Establish well-defined health information
standards[A];
Ensure federal agency compliance with health information standards[A];
Exercise federal leadership in health information standards
adoption[A].
Goals: Goal 2: Interconnect health care;
Objectives: Sustainable electronic health information exchange;
High- level strategies: Stimulate private investment to develop the
capability for efficient sharing of health information[B];
Use government payers and purchasers to foster interoperable electronic
health information exchange[C];
Adapt federal agency health data collection and delivery to NHIN
solutions[C];
Support state and local governments and organizations to foster
electronic health information exchange[B].
Goals: Goal 2: Interconnect health care;
Objectives: Consumer privacy and risk protections;
High-level strategies: Support the development and implementation of
appropriate privacy and security policies, practices, and standards for
electronic health information exchange[A];
Develop and support policies to protect against discrimination from
health information[C].
Goals: Goal 3: Personalize health management;
Objectives: Consumer use of personal health information;
High-level strategies: Establish value of personal health records,
including consumer trust[B];
Expand access to personal health management information and tools[A].
Goals: Goal 3: Personalize health management;
Objectives: Remote monitoring and communications;
High-level strategies: Promote adoption of remote monitoring technology
for communication between providers and patients[A].
Goals: Goal 3: Personalize health management;
Objectives: Care based on culture and traits;
High-level strategies: Promote consumer understanding and provider use
of personal genomics for prevention and treatment of hereditary
conditions[C];
Promote multi-cultural information support[C].
Goals: Goal 4: Improve population health;
Objectives: Automated public health and safety monitoring and
management;
High-level strategies: Enable simultaneous flow of clinical care data
to and among local, state, and federal biosurveillance programs[A];
Ensure that the nationwide health information network supports
population health reporting and management[C].
Goals: Goal 4: Improve population health;
Objectives: Efficient collection of quality information;
High-level strategies: Develop patient-centric quality measures based
on clinically relevant information available from interoperable
longitudinal electronic health records[B];
Ensure adoption of uniform performance measures by health care
stakeholders[C];
Establish standardized approach to centralized electronic data capture
and reporting of performance information[C].
Goals: Goal 4: Improve population health;
Objectives: Transformation of clinical research;
High-level strategies: [Empty].
Goals: Goal 4: Improve population health;
Objectives: Health information support in disasters and crises;
High- level strategies: Foster the availability of field electronic
health records to clinicians responding to disasters[A];
Improve coordination of health information flow during disasters and
crises[C];
Support management of health emergencies[C].
Source: HHS Office of the National Coordinator for Health IT:
[A] Strategy has been initiated:
[B] Strategy is under active consideration:
[C] Strategy requires future discussion:
[End of table]
While HHS has taken additional steps toward completing a national
strategy and has initiated specific activities defined by its strategic
framework, it still lacks the detailed plans, milestones, and
performance measures needed to ensure that its goals are met. While the
National Coordinator acknowledged the need for more detailed plans for
its various initiatives and told us in March that HHS intended to
release a strategic plan with detailed plans and milestones later this
year, current officials with the office could not tell us when detailed
plans and milestones would be defined. Given the complexity of the
tasks at hand and the many activities to be completed, a national
strategy that defines detailed plans, milestones, and performance
measures is essential. Without it, HHS risks not meeting the
President's goal for health IT.
In summary, Mr. Chairman, our work shows that HHS is continuing its
efforts to help transform the use of IT in the health care industry.
However, much work remains. While HHS, through the Office of the
National Coordinator for Health IT and the American Health Information
Community, has initiated specific actions for supporting the goals of a
national strategy, detailed plans and milestones for completing the
various initiatives and performance measures for tracking progress have
not been developed. Until these plans, milestones, and performance
measures are completed, it remains unclear specifically how the
President's goal will be met and what the interim expectations are for
achieving widespread adoption of interoperable electronic health
records by 2014.
Mr. Chairman, this concludes my statement. I would be pleased to answer
any questions that you or other Members of the Subcommittee may have at
this time.
Contacts and Acknowledgments:
If you should have any questions about this statement, please contact
me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Other individuals
who made key contributions to this statement are Amanda C. Gill, Nancy
E. Glover, M. Saad Khan, and Teresa F. Tucker.
Abbreviations:
HHS: Department of Health and Human Services:
IT: information technology:
NIST: National Institute for Standards and Technology:
FOOTNOTES
[1] Health IT is the use of technology to electronically collect,
store, retrieve, and transfer clinical, administrative, and financial
health information.
[2] Executive Order 13335, Incentives for the Use of Health Information
Technology and Establishing the Position of the National Health
Information Technology Coordinator (Washington, D.C.: Apr. 27, 2004).
[3] The American Health Information Community is a federally-chartered
commission made up of representatives from both the public and private
health care sectors.
[4] In late 2005, HHS awarded several contracts to address a range of
issues important for developing a health IT infrastructure, such as
advancing the use of electronic health records, selecting health IT
standards, developing prototypes of a national network, and defining
privacy and security policies.
[5] Ambulatory electronic health records are records of medical care
that includes diagnosis, observation, treatment, and rehabilitation
that is provided on an outpatient basis. Ambulatory care is given to
persons who are able to ambulate, or walk about.
[6] GAO, 21ST Century Challenges: Reexamining the Base of the Federal
Government, GAO-05-325SP (Washington, D.C.: February 2005).
[7] GAO, Information Technology: Benefits Realized for Selected Health
Care Functions, GAO-04-224 (Washington, D.C.: Oct. 31, 2003).
[8] Executive Order 13335.
[9] This position was vacated by the first national coordinator in May
2006. HHS is currently in the process of conducting a nationwide search
for a new national coordinator and a deputy national coordinator.
[10] Executive Order: Promoting Quality and Efficient Health Care in
Federal Government Administered or Sponsored Health Care Programs
(Washington, D.C.: Aug. 22, 2006).
[11] GAO, Health Care: National Strategy Needed to Accelerate the
Implementation of Information Technology, GAO-04-947T (Washington,
D.C.: July 14, 2004).
[12] GAO, Health Information Technology: HHS is Taking Steps to Develop
a National Strategy, GAO-05-628 (Washington, D.C.: May 27, 2005).
[13] GAO, Bioterrorism: Information Technology Strategy Could
Strengthen Federal Agencies' Abilities to Respond to Public Health
Emergencies, GAO-03-139 (Washington, D.C.: May 30, 2003); GAO,
Information Technology: Federal Agencies Face Challenges in
Implementing Initiatives to Improve Public Health Infrastructure, (GAO-
05-308) Washington, D.C.: June 10, 2005).
[14] GAO, Health Care: Continued Leadership Needed to Define and
Implement Information Technology Standards, GAO-05-1054T (Washington,
D.C.: Sept. 29, 2005).
[15] These actions included the lack of mechanisms for better agency
coordination of the various standards efforts, incomplete milestones
associated with these efforts, and no mechanism to monitor the
implementation of standards across the health care industry.
[16] GAO, Health Information Technology: HHS is Continuing Efforts to
Define a National Strategy, GAO-06-346T (Washington, D.C.: Mar. 15,
2006).
[17] Breakthrough areas are components of health care and public health
that can potentially achieve measurable results in 2 to 3 years.
[18] GAO-06-346T.
[19] The Certification Committee for Health IT is a voluntary, private
sector organization that is working to certify health IT products in
three areas: ambulatory electronic health records for the office-based
physician or provider, inpatient electronic health records for
hospitals and health systems, and the network components through which
the electronic health records operate and share information.
[20] The American National Standards Institute is a private, nonprofit
membership organization that coordinates the development and use of
voluntary standards in the United States.
[21] Consolidated Health Informatics was initiated in December 2001 as
an Office of Management and Budget e-government project to establish
federal health information standards to enable federal agencies to
build interoperable health data systems. The project was incorporated
into the Federal Health Architecture in September 2004.
[22] Federal Information Processing Standards are developed by NIST in
collaboration with national and international standards committees,
users, industry groups, consortia, and research and trade organizations
when there are no existing voluntary industry standards to address
federal requirements for the interoperability of different systems, for
the portability of data and software, and for computer security.
[23] The National Committee on Vital and Health Statistics was
established in 1949 as a public advisory committee that is statutorily
authorized to advise the Secretary of HHS on health data, statistics,
and national health information policy, including the implementation of
health IT standards.
[24] Anonymized data are data that have had personally identifying
information removed.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
