In January 2007, we reported on the steps that HHS was taking to ensure  the protection of personal health information exchanged within a  nationwide network and on the challenges facing health information  exchange organizations in protecting electronic personal health  information. HHS Has Taken Steps to Address Privacy Principles and Challenges, but It Has Not Fully Implemented an Overall Privacy Approach

Since January 2007, HHS has undertaken various initiatives that are  contributing to its development of an overall privacy approach, although  more work remains. We recommended that this overall approach  include (1) identifying milestones and the entity responsible for integrating  the outcomes of its privacy-related initiatives, (2) ensuring that key  privacy principles in HIPAA are fully addressed, and (3) addressing key  challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of our  recommendation, and it has taken important steps in addressing the two  other parts. Nevertheless, these steps have fallen short of fully  implementing our recommendation because they do not include a process  for ensuring that all key privacy principles and challenges will be fully and  adequately addressed. The Healthcare Information Technology Standards Panel continued work  to “harmonize” standards directly related to several key privacy principles,  primarily the security principle. Beyond the initiatives previously discussed, in June 2008, the Secretary  released a federal health IT strategic plan that includes a privacy and  security objective for each of its strategic goals, along with strategies and  target dates for achieving the objectives. For example, the officials stated that the purpose of  the American Health Information Community’s use cases is to provide  guidance and establish requirements for privacy protections that are  intended to be implemented throughout the department’s health IT  initiatives (including standards harmonization, electronic health records  certification, and the nationwide health information network). Further, stakeholders  may lack the overall policies and guidance needed to assist them in their  efforts to ensure that privacy protection measures are consistently built  into health IT programs and applications. As a result, the department may  miss an opportunity to establish the high degree of public confidence and  trust needed to help ensure the success of a nationwide health information  network. Recommendation for Executive Action

To ensure that key privacy principles and challenges are fully and  adequately addressed, we recommend that the Secretary of Health and  Human Services direct the National Coordinator for Health IT to include in  the department’s overall privacy approach a process for assessing and  prioritizing its many privacy-related initiatives and the needs of  stakeholders. Specifically, we recommended that the Secretary of  Health and Human Services define and implement an overall approach for  protecting health information that would (1) identify milestones and the  entity responsible for integrating the outcomes of its privacy-related  initiatives, (2) ensure that key privacy principles in the Health Insurance  Portability and Accountability Act of 1996 (HIPAA) are fully addressed,  and (3) address key challenges associated with the nationwide exchange  of health information. To determine the status of HHS’s efforts to develop an overall privacy  approach, we analyzed the department’s federal health IT strategic plan  and documents related to its planned confidentiality, privacy, and security  framework.
Why GAO Did This Study

Although advances in information technology (IT) can improve the quality and other aspects of health care, the electronic storage and exchange of personal health information introduces risks to the privacy of that information. In January 2007, GAO reported on the status of efforts by the Department of Health and Human Services (HHS) to ensure the privacy of personal health information exchanged within a nationwide health information network. GAO recommended that HHS define and implement an overall privacy approach for protecting that information. For this report, GAO was asked to provide an update on HHS's efforts to address the January 2007 recommendation. To do so, GAO analyzed relevant HHS documents that described the department's privacy-related health IT activities.

What GAO Found

Since GAO's January 2007 report on protecting the privacy of electronic personal health information, the department has taken steps to address the recommendation that it develop an overall privacy approach that included (1) identifying milestones and assigning responsibility for integrating the outcomes of its privacy-related initiatives, (2) ensuring that key privacy principles are fully addressed, and (3) addressing key challenges associated with the nationwide exchange of health information. In this regard, the department has fulfilled the first part of GAO's recommendation, and it has taken important steps in addressing the two other parts. The HHS Office of the National Coordinator for Health IT has continued to develop and implement health IT initiatives related to nationwide health information exchange. These initiatives include activities that are intended to address key privacy principles and challenges. For example: (1) The Healthcare Information Technology Standards Panel defined standards for implementing security features in systems that process personal health information. (2) The Certification Commission for Healthcare Information Technology defined certification criteria that include privacy protections for both outpatient and inpatient electronic health records. (3) Initiatives aimed at the state level have convened stakeholders to identify and propose solutions for addressing challenges faced by health information exchange organizations in protecting the privacy of electronic health information. In addition, the office has identified milestones and the entity responsible for integrating the outcomes of its privacy-related initiatives, as recommended. Further, the Secretary released a federal health IT strategic plan in June 2008 that includes privacy and security objectives along with strategies and target dates for achieving them. Nevertheless, while these steps contribute to an overall privacy approach, they have fallen short of fully implementing GAO's recommendation. In particular, HHS's privacy approach does not include a defined process for assessing and prioritizing the many privacy-related initiatives to ensure that key privacy principles and challenges will be fully and adequately addressed. As a result, stakeholders may lack the overall policies and guidance needed to assist them in their efforts to ensure that privacy protection measures are consistently built into health IT programs and applications. Moreover, the department may miss an opportunity to establish the high degree of public confidence and trust needed to help ensure the success of a nationwide health information network.