HHS Has Initiated Actions to Identify Solutions for Protecting Personal Health Information but Has Not Defined an Overall Approach for Addressing Privacy

HHS and its Office of the National Coordinator for Health IT have  initiated actions to identify solutions for protecting health  information. Specifically, HHS awarded several health IT contracts  that include requirements for developing solutions that comply with  federal privacy and security requirements, consulted with the  National Committee on Vital and Health Statistics (NCVHS) to  develop recommendations regarding privacy and confidentiality in  the Nationwide Health Information Network, and formed the  American Health Information Community (AHIC) Confidentiality,  Privacy, and Security Workgroup to frame privacy and security  policy issues and identify viable options or processes to address  these issues. The Office of the National Coordinator for Health IT  intends to use the results of these activities to identify technology  and policy solutions for protecting personal health information as  part of its continuing efforts to complete a national strategy to guide  the nationwide implementation of health IT. However, HHS is in the  early stages of identifying solutions for protecting personal health  information and has not yet defined an overall approach for  integrating its various privacy-related initiatives and for addressing  key privacy principles. In  summer 2006, the privacy and security solutions contractor selected  34 states and territories as locations in which to perform  assessments of organization-level privacy- and security-related  policies and practices that affect interoperable electronic health  information exchange and their bases, including laws and  regulations. The National Committee on Vital and Health Statistics Made Recommendations for Addressing Privacy and Security within a Nationwide Health Information Network

In June 2006, NCVHS, a key national health information advisory  committee, presented to the Secretary of HHS a report  recommending actions regarding privacy and confidentiality in the  Nationwide Health Information Network. The alliance plans to identify privacy  practices and policies to help ensure the protection of personal  health information exchanged within a nationwide health  information network. In summary, concerns about the protection of personal health  information exchanged electronically within a nationwide health  information network have increased as the use of health IT and the  exchange of electronic health information has also increased.
Why GAO Did This Study

In April 2004, President Bush called for the Department of Health and Human Services (HHS) to develop and implement a strategic plan to guide the nationwide implementation of health information technology (IT). The plan is to recommend methods to ensure the privacy of electronic health information. GAO was asked to summarize its January 2007 report. The report describes the steps HHS is taking to ensure privacy protection as part of its national health IT strategy and identifies challenges associated with protecting electronic health information exchanged within a nationwide health information network.

What GAO Found

HHS and its Office of the National Coordinator for Health IT have initiated actions to identify solutions for protecting personal health information through several contracts and with two health information advisory committees. For example, in late 2005, HHS awarded several health IT contracts that include requirements for addressing the privacy of personal health information exchanged within a nationwide health information exchange network. HHS's privacy and security solutions contractor is to assess the organization-level privacy- and security-related policies, practices, laws, and regulations that affect interoperable health information exchange. In June 2006, the National Committee on Vital and Health Statistics made recommendations to the Secretary of HHS on protecting the privacy of personal health information within a nationwide health information network and, in August 2006, the American Health Information Community convened a work group to address privacy and security policy issues for nationwide health information exchange. While its activities are intended to address aspects of key principles for protecting the privacy of health information, HHS is in the early stages of its efforts and has therefore not yet defined an overall approach for integrating its various privacy-related initiatives and addressing key privacy principles, nor has it defined milestones for integrating the results of these activities. GAO identified key challenges associated with protecting electronic personal health information in four areas.