HHS Has Initiated Actions to Identify Solutions for Protecting Personal Health Information but Has Not Defined an Overall Approach for Addressing Privacy

HHS and its Office of the National Coordinator for Health IT have initiated  actions to identify solutions for protecting health information. Specifically,  HHS awarded several health IT contracts that include requirements for  developing solutions that comply with federal privacy and security  requirements, consulted with the National Committee on Vital and Health  Statistics (NCVHS) to develop recommendations regarding privacy and  confidentiality in the Nationwide Health Information Network, and formed  the American Health Information Community (AHIC) Confidentiality,  Privacy, and Security Workgroup to frame privacy and security policy  issues and identify viable options or processes to address these issues. However, HHS is in the early stages of identifying solutions for protecting  personal health information and has not yet defined an overall approach for  integrating its various privacy-related initiatives and for addressing key  privacy principles. In summer 2006, the privacy  and security solutions contractor selected 33 states and Puerto Rico as  locations in which to perform assessments of organization-level privacy-  and security-related policies and practices that affect interoperable  electronic health information exchange and their bases, including laws and  regulations. Conclusions

As the use of health IT and the exchange of electronic health information  increases, concerns about the protection of personal health information  exchanged electronically within a nationwide health information network  have also increased. HHS’s current  initiatives are intended to address many of these challenges. This approach should  (1) identify milestones and the entity responsible for integrating the  outcomes of its privacy-related initiatives, including the results of its four  health IT contracts and recommendations from the NCVHS and AHIC  advisory committees; (2) ensure that key privacy principles in HIPAA are  fully addressed; and (3) address key challenges associated with legal and  policy issues, disclosure of personal health information, individuals’ rights  to request access and amendments to health information, and security  measures for protecting health information within a nationwide exchange  of health information. HHS stated  that the department is committed to ensuring that health information is  protected as part of its efforts to achieve nationwide health information  exchange. Objectives, Scope, and Methodology

The objectives of our review were to  describe the steps the Department of Health and Human Services (HHS)  is taking to ensure privacy protection as part of the national health  information technology (IT) strategy and  identify challenges associated with meeting requirements for protecting  personal health information within a nationwide health information  network.
Why GAO Did This Study

The expanding implementation of health information technology (IT) and electronic health information exchange networks raises concerns regarding the extent to which the privacy of individuals' electronic health information is protected. In April 2004, President Bush called for the Department of Health and Human Services (HHS) to develop and implement a strategic plan to guide the nationwide implementation of health IT. The plan is to recommend methods to ensure the privacy of electronic health information. GAO was asked to describe HHS's efforts to ensure privacy as part of its national strategy and to identify challenges associated with protecting electronic personal health information. To do this, GAO assessed relevant HHS privacy-related initiatives and analyzed information from health information organizations.

What GAO Found

HHS and its Office of the National Coordinator for Health IT have initiated actions to identify solutions for protecting personal health information through several contracts and with two health information advisory committees. For example, in late 2005, HHS awarded several health IT contracts that include requirements for addressing the privacy of personal health information exchanged within a nationwide health information exchange network. Its privacy and security solutions contractor is to assess the organization-level privacy- and security-related policies, practices, laws, and regulations that affect interoperable health information exchange. Additionally, in June 2006, the National Committee on Vital and Health Statistics made recommendations to the Secretary of HHS on protecting the privacy of personal health information within a nationwide health information network, and in August 2006, the American Health Information Community convened a work group to address privacy and security policy issues for nationwide health information exchange. While these activities are intended to address aspects of key principles for protecting the privacy of health information, HHS is in the early stages of its efforts and has therefore not yet defined an overall approach for integrating its various privacy-related initiatives and addressing key privacy principles, nor has it defined milestones for integrating the results of these activities. GAO identified key challenges associated with protecting electronic personal health information in four areas.