Public health officials also use these systems to create the situational  awareness needed to enable early detection of, and effective response  to, emerging diseases and other public health events. HHS Identified Actions for Establishing the Network, but Did Not Address All PAHPRA Requirements Nor Define Measurable Steps to Guide its Efforts

PAHPRA required HHS to conduct four activities related to the  establishment of the public health situational awareness network. Specifically, the plan  lacks any actions to address a required activity for defining the minimal  data elements needed to establish the network, and another activity for  collaborating with public health officials to develop standards for  interpreting and reporting on data collected by the network. Moreover, until HHS  addresses all activities required by PAHPRA in its implementation plan,  the department will not be able to ensure that public health situational  awareness network capabilities will be established in accordance with all  the requirements defined by the law. HHS’s Implementation Plan Does Not Identify Measurable Steps to Meet Requirements of PAHPRA

PAHPRA required HHS to identify measurable steps the Secretary would  carry out to guide the efforts to develop, implement, and evaluate the  network. Further, the law required the National Preparedness and  Response Science Board to assist HHS in its planning efforts by  providing expert advice and guidance, including recommendations,  regarding the measurable steps the Secretary should take to modernize  and enhance public health situational awareness information sharing  capabilities through a biosurveillance network. However, the implementation plan that HHS developed does not identify  timelines, estimates of cost and resource requirements, or performance  metrics that can be used to track and measure progress made toward  completing tasks and, thus, to determine whether expected progress and  outcomes of the IT-related actions are being achieved. HHS officials also did not identify in the implementation plan specific  resource requirements and responsibilities for taking the actions identified  in the plan. However, the National Health Security Strategic  Guidance Committee charter does not include any responsibilities related  to defining steps or overseeing the actions for establishing the network,  and, as of May 2017, the committee had not done so. Moreover, until the  department defines such steps, it will not have the information and  planning tools it needs to make progress toward establishing the network  required by PAHPRA. HHS Reported Limited Progress in Taking Actions Defined in the Implementation Plan to Develop the Network

In the absence of an implementation plan that addresses all of the  activities required by PAHPRA, the department has made limited  progress toward establishing the public health situational awareness  network. Further, ASPR officials did not identify and evaluate other federal  agencies’ and state, local, and tribal public health entities’ existing  electronic information-sharing network capabilities, as required by the  law. Weaknesses in IT Planning and Management Processes Have also Contributed to the Lack of Progress toward Establishing the Network Required by PAHPRA

Beyond the deficiencies in its plans for implementing the network, HHS  did not follow the department’s overall IT planning and management  processes, which contributed to the lack of progress in establishing the  network. In addition, the department’s IT governance organization, led by the CIO,  is to be responsible for ensuring that IT projects are technically sound,  follow established project management practices, and meet the business  owner’s needs. However, had HHS followed  its own departmental guidance for managing IT resources—such as  establishing an IT resource management structure, developing a project  management plan, and defining metrics for tracking performance—the  department would have had the planning tools, resources, and oversight  mechanisms needed to actively pursue efforts to establish the required  network capabilities. Until HHS adheres to departmental guidance for  managing the IT resources necessary to identify and implement  enhancements needed to improve electronic information-sharing  capabilities of systems and networks in use by public health entities  throughout the country, its efforts to establish the nationwide public health  situational awareness network required by PAHPRA will continue to be  hampered. Task the integrated project team with developing a project  management plan that includes measurable steps—including a  timeline of tasks, resource requirements, estimates of costs, and  performance metrics—that can be used to guide and monitor HHS’s  actions to establish the network defined in the plans. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine what progress the  Department of Health and Human Services (HHS) has made towards  establishing electronic situational awareness network capabilities in  accordance with the requirements of the Pandemic and All-Hazards  Preparedness Reauthorization Act of 2013 (PAHPRA).
Why GAO Did This Study

A public health event, such as a widespread disease outbreak or health problems resulting from a weather-related emergency, could have catastrophic consequences for the nation. These potential threats can be partially mitigated by having a national public health situational awareness capability—that is, a capability for public health officials to be able to access real-time information about emerging threats to enable them to make timely, responsive decisions to prepare for and respond to emergencies. PAHPRA required HHS to establish a near real-time electronic nationwide public health situational awareness capability through an interoperable network of systems.
PAHPRA also included a provision for GAO to evaluate HHS's progress in developing such a capability. This report addresses what progress HHS has made toward establishing the network. GAO analyzed documents describing HHS's plan for enhancing public health situational awareness and evaluated evidence of actions taken by HHS to establish the network required by PAHPRA. GAO also examined the department's IT planning and management processes and guidance, and interviewed HHS officials.

What GAO Found

The Pandemic and All-Hazards Preparedness Reauthorization Act of 2013 (PAHPRA) required the Secretary of Health and Human Services (HHS) to establish an electronic nationwide public health situational awareness network and to develop an implementation plan to guide its efforts. The law further required HHS to include in its plan specific activities for incorporating data into the network. HHS developed an implementation plan that identified several actions related to enhancing existing information-sharing capabilities needed to establish the network. However, the actions identified in the plan did not address all of the required activities, such as defining data elements and standards. Until the department addresses all required activities, it will lack an effective tool for ensuring that public health situational awareness network capabilities have been established in accordance with all of the requirements defined by the law.
In addition, HHS did not identify measurable steps for completing and tracking the status of the activities required by the law. PAHPRA required HHS to include in its plan the measurable steps to be taken to establish the network. Federal guidance also suggests that implementation plans identify timelines of tasks, cost and resource estimates, and performance metrics that can be used to track and monitor progress toward completing tasks and delivering expected outcomes. According to HHS officials who developed the implementation plan, the department established a committee of policy and planning experts from various federal agencies to define the measurable steps for completing the actions identified in the plan. However, HHS did not assign responsibilities for defining such steps to the committee, and the committee had not done so. Until the department defines measurable steps, it will not have the information and planning tools it needs to make progress toward establishing a network that provides information-sharing capabilities needed by public health entities to prepare for and respond to emergencies, as required by PAHPRA.
GAO identified other weaknesses in HHS's planning efforts that have contributed to the department's lack of progress toward establishing the network. Specifically, HHS did not follow guidance developed by its Chief Information Officer (CIO) for managing information technology (IT) resources. According to the guidance, officials who manage IT initiatives are to involve a governance organization led by HHS's CIO and designate a project team that includes a project manager and business owner. The team is to manage and oversee initiatives according to the guidance, including the development of a project management plan that identifies timelines and schedules, estimated project resources and costs, and performance metrics for tracking any progress made toward completing tasks and delivering expected outcomes. However, HHS did not designate such a team and did not involve the CIO in its planning efforts. As such, the department lacks the structure and mechanisms needed to plan, manage, and oversee actions for establishing the network. Until HHS adheres to its own guidance for managing the IT resources necessary to improve electronic information-sharing capabilities of systems and networks in use by public health entities throughout the country, it will likely continue to fall short in its efforts to establish the nationwide public health situational awareness network required by PAHPRA.

What GAO Recommends

GAO is recommending that HHS complete a plan that includes all actions for establishing the network, develop a project management plan that identifies measurable steps for completing the actions, and conduct IT management processes according to CIO guidance. HHS had no comments on the report or recommendations.