However, the Privacy Rule permits the use or  disclosure of personal health information for treatment, payment, and  other health care operations. Health Information Technology for Economic and Clinical Health Act

The HITECH Act includes a series of privacy and security provisions that  expand certain provisions under HIPAA. HIEs and Providers Describe Various Methods of Implementing Disclosure Practices

The four exchanges in our case studies reported that they implement  various practices to ensure appropriate disclosure of electronic personal  health information for treatment purposes. Some of the providers reported that they inform patients that their  electronic personal health information may be shared through a health  information exchange. Additionally, providers  stated that they implement practices to facilitate patients’ ability to access  and request corrections to personal health information, and all the HIEs  and providers described practices intended to limit the disclosure and use  of information to specific purposes. By allowing access to the electronic  information about patients that they have stored in their health  information systems, the HIEs support the providers’ ability to provide  care to new patients and to patients in emergency situations. Providers reported that they  implement similar security mechanisms to protect the electronic personal  health information that they store. HIEs, Providers Other Entities Reported Examples o Ways the Electroni Sharing of Health Information Has a n Positive Effect o Quality of Care

Although the exchanges stated that they had not conducted formal studie of the effects of electronic sharing of personal health information on the  quality of care their providers deliver, three of the HIEs repo of positive effects resulting from the services they provide. Two of these three exchanges provide a direct connection from  participating hospitals to the state’s Department of Public Health for re time reporting of conditions and for supporting the early detection of  disease outbreaks. According to an official with one of these exchanges,  this service facilitated the state’s ability t f H1N1 more quickly than other states. A medium-sized hospital stated that information obtained through the HIE helped their emergency department physician ascertain that a patient who was requesting medication for pain had been in five area hospitals in seven  nights seeking pain medication. The physician did not prescribe any pain  medication for the patient. elped to eliminate duplication of exams by the health department or    A large hospital from one of the exchanges reported that their cardio was able to obtain an abnormal laboratory result electronically  exchange one day before they would have without using it, allowing  earlier intervention for a potentially life-threatening condition. Appendix I: Objectives, Scope, and Methodology

Our objectives were to describe (1) the practices implemented for  disclosing personal health information for purposes of treatment,  including the use of electronic means for obtaining consent, as reported by  selected health information exchanges, their participating providers, and  other entities; and (2) the effects of the electronic sharing of health  information on the quality of care for patients as reported by these  organizations. To address both objectives, we conducted case studies of selected health  information exchanges and their participating providers. To select the case study health  information exchanges, we compiled a list of 68 health information  exchanges that were reported to be operational and actively sharing data  among providers. For each of the four case studies, we    gathered documentation and conducted interviews with the exchanges to  determine the practices they implemented for disclosing personal health  information, including electronic means of obtaining consent, practices  they required for participating providers, and reported effects of sharing  health information electronically on the quality of care; and    gathered documentation and conducted interviews with officials from  selected participating providers to determine the practices they  implemented as part of the health information exchange and the practices  they had implemented in their own organization for disclosing personal  health information.
Why GAO Did This Study

To promote the use of information technology for the electronic exchange of personal health information among providers and other health care entities, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act. It provides incentives intended to promote the widespread adoption of technology that supports the electronic sharing of data among hospitals, physicians, and other health care entities. Pursuant to a requirement in the HITECH Act, GAO is reporting on practices implemented by health information exchange organizations, providers, and other health care entities that disclose electronic personal health information. GAO's specific objectives were to describe (1) the practices implemented for disclosing personal health information for purposes of treatment, including the use of electronic means for obtaining consent, as reported by selected health information exchange organizations, their participating providers, and other entities; and (2) the effects of the electronic sharing of health information on the quality of care for patients as reported by these organizations. To address both objectives, GAO conducted case studies of 4 of more than 60 operational health information exchanges and a selection of each of the exchanges' participating providers.

What GAO Found

The health care entities GAO studied reported that they implement disclosure practices that reflect widely accepted practices for safeguarding personal information-the Fair Information Practices-to help ensure the appropriate use and disclosure of electronic personal health information for treatment purposes. For example, providers in the study described various implementations of practices that require direct interaction with patients, such as informing patients of the use and disclosure of personal health information and providing patients access to their own records. Some of them inform patients that their electronic personal health information may be shared through health information exchanges-entities that were formed to facilitate the electronic sharing of patients' health information among providers. Both the providers and exchanges in the study described practices that limit disclosure of information, secure electronic information that they store and transmit, and help ensure accountability for safeguarding electronic personal health information. Although the health information exchanges reported that they have not conducted formal studies or evaluations of the overall effect of electronically sharing personal health information, both the exchanges and providers reported examples of ways that sharing electronic personal health information about patients has had a positive effect on the quality of care that providers deliver to patients. (1) Officials from two exchanges stated that they provide a direct connection from participating hospitals to their state's Department of Public Health for real-time reporting of conditions and for supporting the early detection of disease outbreaks. According to one of these officials, this service facilitated the state's ability to obtain information about cases of H1N1 more quickly than other states. (2) A large hospital that participated in one of the exchanges reported that a cardiologist was able to obtain an abnormal laboratory result electronically from the exchange one day earlier than they would have otherwise. This timely access to the patients' electronic health information allowed the provider to perform earlier intervention for a potentially life-threatening condition. (3) Another hospital reported that information obtained through its health information exchange helped its emergency department physician ascertain that a patient who was requesting medication for pain had been in five area hospitals in seven nights seeking pain medication. As a result, the physician did not prescribe any additional pain medication.