An EHR  is a digital version of a patient’s paper medical record or chart. The Privacy Rule establishes national standards for safeguarding  protected health information (PHI). Electronic Health Information Can Offer Substantial Benefits but Faces a Variety of Security and Privacy Threats

		Electronic Health Information Provides Many Benefits to Patients and Providers

The use of health information technology, including EHR systems, has  the potential to allow health care providers and others to share health  care information electronically, which may lead to improved health care  quality and reduced costs. Based on these data, over 113 million individual health  care records were compromised in 2015 due to hacking or other  incidents. The following are examples of recent large data breaches involving health  care information. HHS Security and Privacy Guidance Does Not Fully Address Important Controls Outlined in Federal Guidance

To encourage covered entities and business associates to implement  effective security and privacy protections, HHS established guidance for  compliance with the HIPAA requirements regarding the security and  privacy of protected health information. However, it does not address controls in other risk assessment  subcategories, such as penetration testing and developing risk  responses. Yet, without follow up, OCR cannot  determine whether corrective actions have actually been made to address  identified problems or whether covered entities have responded to  technical assistance with improvements to their electronic health  information protections. However, OCR has not yet established benchmarks or performance  measures to assess the effectiveness of the audit program when it  becomes operational. Specifically, OCR does not notify CMS of investigative cases it has  completed in which it has determined that risks assessments were not  conducted. However, HHS’s guidance does not address how  covered entities should tailor their implementations of key security  controls identified by the National Institute of Standards and Technology  to their specific needs, and thus may not be as effective as it could be. Recommendations for Executive Action

To improve the effectiveness of HHS guidance and oversight of privacy  and security for health information we recommend that the Secretary of  Health and Human Services take the following actions: update security guidance for covered entities and business associates  to ensure that the guidance addresses implementation of controls  described in the NIST Cybersecurity Framework; update technical assistance that is provided to covered entities and  business associates to address technical security concerns;  revise the current enforcement program to include following up on the  implementation of corrective actions; establish performance measures for the OCR audit program; and establish and implement policies and procedures for sharing the  results of investigations and audits between OCR and CMS to help  ensure that covered entities and business associates are in  compliance with HIPAA and the HITECH Act. HHS stated that it concurred with three of the  five recommendations in the draft report and would take actions to  implement them. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the expected benefits and cyber  threats to electronic health information; (2) determine the extent to which  the Department of Health and Human Services’ (HHS) security and  privacy guidance for electronic health records reflect and align with  federal guidance; and (3) assess the extent to which HHS oversees  compliance with HHS information security and privacy requirements at  covered entities. We identified these experts and  stakeholders through interviews with agency officials and other  stakeholders. We also obtained key  documents from a representative sample of Security, Breach Notification,  and Privacy Rules investigations conducted by HHS’s Office of Civil  Rights (OCR) that were closed between January 1, 2015, and December  10, 2015.
Why GAO Did This Study

As a digital version of a patient's medical record or chart, an EHR can make pertinent health information more readily available and usable for providers and patients. However, recent data breaches highlight the need to ensure the security and privacy of these records. HHS has primary responsibility for setting standards for protecting electronic health information and for enforcing compliance with these standards.
GAO was asked to review the current health information cybersecurity infrastructure. The specific objectives were to (1) describe expected benefits of and cyber threats to electronic health information, (2) determine the extent to which HHS security and privacy guidance for EHRs are consistent with federal cybersecurity guidance, and (3) assess the extent to which HHS oversees these requirements. To address these objectives, GAO reviewed relevant reports, federal guidance, and HHS documentation and interviewed subject matter experts and agency officials.

What GAO Found

The use of electronic health information can allow providers to more efficiently share information and give patients easier access to their health information, among other benefits. Nonetheless, systems storing and transmitting health information in electronic form are vulnerable to cyber-based threats. The resulting breaches—involving over 113 million records in 2015—can have serious adverse impacts such as identity theft, fraud, and disruption of health care services, and their number has increased steadily in recent years, from 0 in 2009 to 56 in 2015 (see figure).
The Department of Health and Human Services (HHS) has established guidance for covered entities, such as health plans and care providers, for use in their efforts to comply with HIPAA requirements regarding the privacy and security of protected health information, but it does not address all elements called for by other federal cybersecurity guidance. Specifically, HHS's guidance does not address how covered entities should tailor their implementations of key security controls identified by the National Institute of Standards and Technology to their specific needs. Such controls include developing risk responses, among others. Further, covered entities and business associates have been challenged to comply with HHS requirements for risk assessment and management. Without more comprehensive guidance, covered entities may not be adequately protecting electronic health information from compromise.
HHS has established an oversight program for compliance with privacy and security regulations, but actions did not always fully verify that the regulations were implemented. Specifically, HHS's Office of Civil Rights investigates complaints of security or privacy violations, almost 18,000 of which were received in 2014. It also has established an audit program for covered entities' security and privacy programs. However, for some of its investigations it provided technical assistance that was not pertinent to identified problems, and in other cases it did not always follow up to ensure that agreed-upon corrective actions were taken once investigative cases were closed. Further, the office has not yet established benchmarks to assess the effectiveness of its audit program. These weaknesses result in less assurance that loss or misuse of health information is being adequately addressed.

What GAO Recommends

GAO is making five recommendations, including that HHS update its guidance for protecting electronic health information to address key security elements, improve technical assistance it provides to covered entities, follow up on corrective actions, and establish metrics for gauging the effectiveness of its audit program. HHS generally concurred with the recommendations and stated it would take actions to implement them.