To electronically transmit prescription  drug data between a health care provider and a pharmacy, an electronic  health record can be used to obtain information about the health of an  individual or the care provided by a health practitioner. These reports and other related information are required by  the HITECH Act to be made publicly available on HHS’s website. HHS Has a Framework for Protecting Medicare Beneficiaries’ Prescription Drug Use Information but Has Not Issued Required Guidance or Implemented Required Oversight Capabilities

In response to requirements set forth in HIPAA and the HITECH Act,  HHS, through OCR, has established a framework for protecting the  privacy and security of individually identifiable health information,  including Medicare beneficiaries’ prescription drug use information used  for purposes other than directly providing clinical care. However, OCR has not  issued required guidance to assist entities in de-identifying individually  identifiable health information due to—according to officials—competing  priorities for resources and internal and external reviews. Furthermore,  although it has recently initiated a pilot audit program, the office has not  implemented periodic compliance audits as required by the HITECH Act. The  expert determination method requires a qualified statistician or other  appropriate expert, using generally accepted statistical and scientific  principles, to determine that the risk is very small that an individual could  be identified from the information when used alone or in combination with  other reasonably available information. Specifically,  to implement provisions of the HITECH Act, the Secretary was required to  (1) issue breach notification regulations to require covered entities and  business associates under HIPAA to provide notification to affected  individuals and the Secretary concerning the unauthorized use and  disclosure of unsecured PHI; (2) establish enforcement provisions for  imposing an increased tiered structure for civil money penalties for  violations of the Privacy and Security Rules; and (3) extend certain  Privacy and Security Rule requirements to business associates of  covered entities. OCR Provides Guidance and Outreach on the Use of PHI, but Has Not Issued Required De-identification Guidance

The HITECH Act also requires HHS to educate members of the public  about how their PHI, which may include Medicare beneficiaries’  prescription drug use information, may be used. According to OCR officials,  competing priorities for resources and internal reviews have delayed the  issuance of the guidance. Specifically, HHS has authority to enforce compliance  with the Privacy and Security Rules in response to, among other things,  (1) complaints reporting potential privacy and security violations and (2)  data breach notifications submitted by covered entities. OCR receives thousands of complaints and breach notifications each  year. In June 2011, OCR initiated efforts to conduct pilot audits of 150 covered  entities by the end of December 2012. OCR  officials anticipate that this review will help determine how the office can  fully implement an audit function. Conclusions

Through its issuance of regulations, outreach, and enforcement activities,  HHS has established a framework for protecting the privacy and security  of Medicare beneficiaries’ prescription drug use information when used  for purposes other than directly providing clinical care. It has also  promoted public awareness on the uses and disclosures of PHI through  its education and outreach activities. Specifically, OCR has yet  to establish plans for a sustained audit capability upon completion of its  pilot program at the end calendar year 2012 and has yet to determine  how to include auditing business associates. Without a plan for deploying  a sustained audit capability on an ongoing basis, OCR will have limited  assurance that covered entities and business associates are complying  with HIPAA regulations, including whether Medicare beneficiaries’  prescription drug use information, when used for purposes other than  directly providing clinical care, is being appropriately safeguarded from  compromise. Recommendations for Executive Action

To improve the department’s guidance and oversight efforts for ensuring  the privacy and security of protected health information, including  Medicare beneficiaries’ prescription drug use information, we recommend  that the Secretary of HHS direct the Director of the Office for Civil Rights  to take the following two actions:  Issue guidance on properly implementing the HIPAA Privacy Rule  requirements for the de-identification of protected health information. Until such implementation  guidance is issued, increased risk exists that covered entities are not  properly adhering to the standards set by the HIPAA Privacy Rule and  that PHI is not properly stripped of all identifiers that would identify an  individual. Regarding our recommendation that OCR establish plans for conducting  periodic audits to ensure covered entities and business associates are  complying with the HIPAA Privacy and Security Rules and breach  notification standards, the Assistant Secretary stated the department did  not agree with our report’s conclusion that without such a plan, OCR will  lack the ability to ensure that covered entities and business associates  are complying with the HIPAA rules. Appendix I: Objective, Scope, and Methodology

Our objective was to determine the extent to which the Department of  Health and Human Services (HHS) has established a framework to  ensure the privacy and security of Medicare beneficiaries’ protected  health information (PHI) when data on prescription drug use are used for  purposes other than their direct clinical care.
Why GAO Did This Study

Prescribing medications and filling those prescriptions increasingly relies on the electronic collection of individuals health information and its exchange among health care providers, pharmacies, and other parties. While this can enhance efficiency and accuracy, it also raises privacy and security concerns. Federal law establishes the authority for the Secretary of HHS to develop standards for protecting individuals health information (which includes Medicare beneficiaries) and to ensure that covered entities (such as health care providers and pharmacies) and their business associates comply with these requirements.
The Medicare Improvements for Patients and Providers Act of 2008 required GAO to report on prescription drug use data protections. GAOs specific objective for this review was to determine the extent to which HHS has established a framework to ensure the privacy and security of Medicare beneficiaries protected health information when data on prescription drug use are used for purposes other than direct clinical care. To do this, GAO reviewed HHS policies and other related documentation and interviewed agency officials.

What GAO Found

While the Department of Health and Human Services (HHS) has established a framework for protecting the privacy and security of Medicare beneficiaries prescription drug use information when used for purposes other than direct clinical care through its issuance of regulations, outreach, and enforcement activities, it has not issued all required guidance or fully implemented required oversight capabilities. HHS has issued regulations including the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules to safeguard protected health information from unauthorized use and disclosure. Through its Office for Civil Rights (OCR), HHS has undertaken a variety of outreach and educational efforts to inform members of the public and covered entities about the uses of protected health information. Specifically, OCR has made available on its website guidance and other materials informing the public about the uses to which their personal information may be put and the protections afforded to that information by federal laws. It has also made available guidance to covered entities and their business associates that is intended to promote compliance with the HIPAA Privacy and Security Rules.
However, HHS has not issued required implementation guidance to assist entities in de-identifying personal health information including when it is used for purposes other than directly providing clinical care to an individual. This means ensuring that data cannot be linked to a particular individual, either by removing certain unique identifiers or by applying a statistical method to ensure that the risk is very small that an individual could be identified. According to OCR officials, the completion of the guidance, required by statute to be issued by February 2010, was delayed due to competing priorities for resources and internal reviews. Until the guidance is issued, increased risk exists that covered entities are not properly implementing the standards set forth by federal regulations for de-identifying protected health information.
Additionally, in enforcing compliance with the HIPAA Privacy and Security Rules, OCR has established an investigations process for responding to reported violations of the rules. Specifically, the office annually receives thousands of complaints from individuals and notices of data breaches from covered entities, and initiates investigations as appropriate. If it finds that a violation has occurred, the office can require covered entities to take corrective action and pay fines and penalties.
HHS was also required by law to implement periodic compliance audits of covered entities compliance with HHS privacy and security requirements; however, while it has initiated a pilot program for conducting such audits, it does not have plans for establishing a sustained audit capability. According to OCR officials, the office has completed 20 audits and plans to complete 95 more by the end of December 2012, but it has not established plans for continuing the audit program after the completion of the pilots or for auditing covered entities business associates. Without a plan for establishing an ongoing audit capability, OCR will have limited assurance that covered entities and business associates are complying with requirements for protecting the privacy and security of individuals personal health information.

What GAO Recommends

GAO recommends that HHS issue de-identification guidance and establish a plan for a sustained audit capability. HHS generally agreed with both recommendations but disagreed with GAOs assessment of the impacts of the missing guidance and lack of an audit capability. In finalizing its report, GAO qualified these statements as appropriate.