This is the accessible text file for GAO report number GAO-06-1071T 
entitled 'Health Information Technology: HHS is Continuing Efforts to 
Define It's National Strategy' which was released on September 1, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 

GAO: 

Testimony: 

Before the Subcommittee on Federal Workforce and Agency Organization, 
Committee on Government Reform, House of Representatives: 

For Release on Delivery: 

Expected at 1:00 p.m. CDT Friday, September 1, 2006: 

Health Information Technology: 

HHS is Continuing Efforts to Define Its National Strategy: 

Statement of David A. Powner: 
Director, Information Technology Management Issues: 

GAO-06-1071T: 

GAO Highlights: 

Highlights of GAO-06-1071T, a testimony before the Subcommittee on 
Federal Workforce and Agency Organization, Committee on Government 
Reform, House of Representatives 

Why GAO Did This Study: 

As GAO and others have reported, the use of information technology (IT) 
has enormous potential to improve the quality of health care and is 
critical to improving the performance of the U.S. health care system. 
Given the federal governmentís role in providing health care in the 
U.S., it has been urged to take a leadership role in driving change to 
improve the quality and effectiveness of health care, including the 
adoption of IT. In April 2004, President Bush called for widespread 
adoption of interoperable electronic health records within 10 years and 
issued an executive order that established the position of the National 
Coordinator for Health Information Technology. A National Coordinator 
within the Department of Health and Human Services (HHS) was appointed 
in May 2004 and released a framework for strategic action two months 
later. In May 2005, GAO recommended that HHS establish detailed plans 
and milestones for each phase of the framework and take steps to ensure 
that its plans are followed and milestones are met. 

GAO was asked to identify progress made by HHS toward the development 
and implementation of a national health IT strategy. To do this, GAO 
reviewed prior reports and agency documents on the current status of 
relevant HHS activities. 

What GAO Found: 

In late 2005, to help define the future direction of a national 
strategy, HHS awarded several health IT contracts and formed the 
American Health Information Community, a federal advisory committee 
made up of health care stakeholders from both the public and private 
sectors. Through the work of the these contracts and the community, HHS 
and its Office of the National Coordinator for Health IT have made 
progress in five major areas associated with the Presidentís goal of 
nationwide implementation of health IT (see table). 

Table: Five Areas of Progress and Supporting Activities: 

Areas of Progress: Advancing use of electronic health records; 
Activities: 
* Defined initial certification criteria for certain electronic health 
records and certified 22 vendorsí products;
* Presented functional requirements for inclusion of patient 
information into electronic health records; 
* Initiated work to advance the use of electronic health records to 
rebuild medical records following disasters. 

Areas of Progress: Establishing interoperability standards for a health 
information exchange; Activities: 
* American National Standards Institute Health IT Standards Panel 
selected 90 interoperability standards for areas such as electronic 
health records and public health detection and reporting;
* Coordinated with the National Institute for Standards and Technology 
to align federal and private sector standards for interoperable health 
IT. 

Areas of Progress: Developing prototypes of a nationwide health 
information network; Activities: 
* Awarded contracts for developing prototypes for a national network to 
four contractors; 
* Proposed more than 1000 functional requirements; 
* Held the first nationwide health information forum. 

Areas of Progress: Addressing privacy and security issues associated 
with the nationwide exchange of health information; Activities: 
* Contracted with 34 states and territories to perform assessments of 
the impact of policies and laws on security and privacy practices;
* Selected standards to help ensure privacy and confidentiality;
* Formed a new workgroup to specifically address privacy and security 
policy issues;
* Made recommendations covering topics that are central to challenges 
for protecting health information privacy in a national health 
information exchange environment. 

Areas of Progress: Integrating public health systems into a national 
network; Activities: 
* Made recommendations to help support sharing of clinical care data 
with local, state, and federal biosurveillance programs, including the 
development of materials for public education on benefits to public 
health and national security, and the protection of patient 
confidentiality;
* Selected information exchange standards for sharing clinical health 
information with public health. 

Source: GAO analysis of HHS data. 

[End of Table] 

These activities and others are being used by the Office of the 
National Coordinator for Health IT to continue its efforts to complete 
a national strategy to guide the nationwide implementation of 
interoperable health IT. Since the release of its initial framework in 
2004, the office has defined objectives and high-level strategies for 
accomplishing its goals. Although HHS agreed with GAOís prior 
recommendations and has made progress in these areas, it still lacks 
detailed plans, milestones, and performance measures for meeting the 
Presidentís goals. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-1071T]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact David A. Powner at 
(202)512-9286 or pownerd@gao.gov. 

[End of Section] 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to comment on federal efforts to advance 
the use of information technology (IT) for health care delivery and 
public health. As we and others have reported, the use of IT has 
enormous potential to improve the quality of health care and is 
critical to improving the performance of the U.S. health care system. 

Recognizing the potential value of IT in public and private health care 
systems, the federal government has been working to promote the 
nationwide use of health IT.[Footnote 1] In April 2004, President Bush 
called for widespread adoption of interoperable electronic health 
records within 10 years and issued an executive order[Footnote 2] that 
established the position of the National Coordinator for Health 
Information Technology within the Department of Health and Human 
Services (HHS). The National Coordinator's responsibilities include the 
development and implementation of a strategic plan to guide the 
nationwide implementation of interoperable health IT in both the public 
and private sectors. 

At your request, today we will discuss progress made by HHS and its 
Office of the National Coordinator for Health IT toward the development 
and implementation of a national health IT strategy. In preparing this 
statement, we reviewed agency documents on the current status of HHS's 
activities related to a national health IT strategy and supplemented 
our analysis with interviews of agency officials. We also summarized 
prior GAO reports. Our work was performed in accordance with generally 
accepted auditing standards. 

Results in Brief: 

HHS and its Office of the National Coordinator for Health IT have made 
progress through the work of the American Health Information 
Community[Footnote 3] and several recently-awarded contracts[Footnote 
4] in five major areas: (1) defining certification criteria for and 
certifying electronic health records, (2) identifying interoperability 
standards to facilitate the exchange of patient data, (3) defining 
requirements for the development of prototypes for the Nationwide 
Health Information Network, (4) addressing privacy and security issues 
associated with the nationwide exchange of health information, and (5) 
taking steps to integrate public health into a nationwide health 
information exchange. Specifically, certification criteria for 
ambulatory electronic health records[Footnote 5] have been defined and 
22 electronic health records vendors have achieved certification for 
their products. Additionally, 90 interoperability standards have been 
selected for areas such as electronic health records and public health 
detection and reporting, and functional requirements for a nationwide 
health information network have been proposed. The American Health 
Information Community has also formed a workgroup to specifically 
address confidentiality and security issues relevant to a nationwide 
health information exchange. 

These activities and others are being used by the Office of the 
National Coordinator for Health IT to continue its efforts to complete 
a national strategy to guide the nationwide implementation of 
interoperable health IT. Since the release of its initial framework in 
2004, the office has defined objectives and high-level strategies for 
accomplishing its goals. However, while HHS has made progress in these 
areas, it still lacks detailed plans, milestones, and performance 
measures for meeting the President's goals. 

Background: 

Studies published by the Institute of Medicine and others have 
indicated that fragmented, disorganized, and inaccessible clinical 
information adversely affects the quality of health care and 
compromises patient safety. In addition, long-standing problems with 
medical errors and inefficiencies increase costs for health care 
delivery in the United States. With health care spending in 2004 
reaching almost $1.9 trillion, or 16 percent, of the gross domestic 
product, concerns about the costs of health care continue. As we 
reported last year, many policy makers, industry experts, and medical 
practitioners contend that the U.S. health care system is in a 
crisis.[Footnote 6] 

Health IT provides a promising solution to help improve patient safety 
and reduce inefficiencies. The expanded use of health IT has great 
potential to improve the quality of care, bolster the preparedness of 
our public health infrastructure, and save money on administrative 
costs. As we reported in 2003, technologies such as electronic health 
records and bar coding of certain human drug and biological product 
labels have been shown to save money and reduce medical 
errors.[Footnote 7] For example, a 1,951-bed teaching hospital reported 
that it realized about $8.6 million in annual savings by replacing 
outpatient paper medical charts with electronic medical records. This 
hospital also reported saving more than $2.8 million annually by 
replacing its manual process for managing medical records with an 
electronic process to provide access to laboratory results and reports. 
Health care organizations also reported that IT contributed other 
benefits, such as shorter hospital stays, faster communication of test 
results, improved management of chronic diseases, and improved accuracy 
in capturing charges associated with diagnostic and procedure codes. 
However, according to HHS, only a small number of U.S. health care 
providers have fully adopted health IT due to significant financial, 
technical, cultural, and legal barriers such as a lack of access to 
capital, a lack of data standards, and resistance from health care 
providers. 

Federal Government's Role in Health Care: 

According to the Institute of Medicine, the federal government has a 
central role in shaping nearly all aspects of the health care industry 
as a regulator, purchaser, health care provider, and sponsor of 
research, education, and training. Seven major federal health care 
programs, such as Medicare and Medicaid, provide health care services 
to approximately 115 million Americans. According to HHS, federal 
agencies fund more than a third of the nation's total health care 
costs. Table 1 summarizes the programs and number of citizens who 
receive health care services from the federal government and the cost 
of these services. 

Table 1: Beneficiaries and Expenditures in Major Federal Health Care 
Programs for Fiscal Year 2004: 

Federal agency: HHS; 
Program: Medicare; 
Beneficiaries: 42 million elderly and disabled beneficiaries; 
Expenditure: (in billions): $309. 

Federal agency: HHS; 
Program: Medicaid; 
Beneficiaries: 43.7 million low-income persons; 
Expenditure: (in billions): 276.8; (joint federal and state). 

Federal agency: HHS; 
Program: State Children's Health Insurance Program; 
Beneficiaries: 5.8 million children[A]; 
Expenditure: (in billions): 6.6; (joint federal and state). 

Federal agency: HHS; 
Program: Indian Health Service; 
Beneficiaries: 1.8 million Native Americans and Alaska Natives; 
Expenditure: (in billions): 3.7. 

Federal agency: Veterans Affairs; 
Program: Veterans Health Administration; 
Beneficiaries: 5.2 million veterans; 
Expenditure: (in billions): 26.8. 

Federal agency: Department of Defense; 
Program: Tricare Program; 
Beneficiaries: 8.3 million active-duty military personnel and their 
families, and military retirees; 
Expenditure: (in billions): 30.4. 

Federal agency: Office of Personnel Management; 
Program: Federal Employees Health Benefit Program; 
Beneficiaries: 8 million federal employees, retirees, and dependents; 
Expenditure: (in billions): 27. 

Source: HHS, VA, DOD, and OPM budget documents. 

[A] Based on fiscal year 2003 data. 

[End of table] 

Given the level of the federal government's participation in providing 
health care, it has been urged to take a leadership role in driving 
change to improve the quality and effectiveness of medical care in the 
United States, including an expanded adoption of IT. 

In April 2004, President Bush called for the widespread adoption of 
interoperable electronic health records within 10 years and issued an 
executive order[Footnote 8] that established the position of the 
National Coordinator for Health Information Technology within HHS. The 
National Coordinator's responsibilities include the development and 
implementation of a strategic plan to guide the nationwide 
implementation of interoperable health IT in both the public and 
private sectors. The first National Coordinator was appointed in May 
2004,[Footnote 9] and two months later HHS released The Decade of 
Health Information Technology: Delivering Consumer-centric and 
Information-rich Health Care--Framework for Strategic Action, the first 
step toward the development of a national strategy. The framework 
described goals for achieving nationwide interoperability of health IT 
and actions to be taken by both the public and private sectors to 
implement a strategy. Just last week, President Bush issued an 
executive order calling for federal health care programs and their 
providers, plans, and insurers to use IT interoperability standards 
recognized by HHS.[Footnote 10] 

Need for a National Strategy and Greater Interoperability: 

In the summer of 2004, we testified on the benefits that effective 
implementation of IT can bring to the health care industry and the need 
for HHS to provide continued leadership, clear direction, and 
mechanisms to monitor progress in order to bring about measurable 
improvements.[Footnote 11] Last year, we reported that HHS, through the 
Office of the National Coordinator for Health IT, had taken a number of 
actions toward accelerating the use of IT to transform the health care 
industry. To further accelerate the adoption of interoperable health 
information systems, we recommended that HHS establish detailed plans 
and milestones for meeting the goals of its framework for strategic 
action and take steps to ensure that those plans are followed and 
milestones are met.[Footnote 12] The department agreed with our 
recommendation. 

We also reported in June 2005 that challenges associated with major 
public health IT initiatives still need to be overcome to strengthen 
the IT that supports the public health infrastructure.[Footnote 13] 
Federal agencies face many challenges in their efforts to improve the 
public health infrastructure, including (1) the integration of current 
initiatives into a national health IT strategy and federal architecture 
to reduce the risk of duplicative efforts, (2) development and adoption 
of consistent standards to encourage interoperability, (3) coordination 
of initiatives with state and local agencies to improve the public 
health infrastructure, and (4) overcoming federal IT management 
weaknesses to improve progress on IT initiatives. To address these 
challenges, we recommended that HHS align federal public health 
initiatives with the national health IT strategy and federal health 
architecture, coordinate with state and local public health agencies, 
and continue federal actions to encourage the development and adoption 
of data standards. 

Last September, we testified about the importance of defining and 
implementing data and communication standards to speed the adoption of 
interoperable IT in the health care industry.[Footnote 14] Hurricane 
Katrina highlighted the need for interoperable electronic health 
records as thousands of people were separated from their health care 
providers and their paper medical records were lost. As we have noted, 
standards are critical to enabling this interoperability. Although 
federal leadership has been established to accelerate the use of IT in 
health care, we testified that several actions[Footnote 15] were still 
needed to position HHS to further define and implement relevant 
standards. Otherwise, the health care industry will continue to be 
plagued with incompatible systems that are incapable of exchanging 
medical information that is critical to delivering care and responding 
to public health emergencies. 

In March 2006, we testified before this subcommittee[Footnote 16] on 
HHS's continued efforts to move forward with its mission to guide the 
nationwide implementation of interoperable health IT in the public and 
private health care sectors. We identified several steps taken by the 
department, such as the establishment of the organizational structure 
and management team for the Office of the National Coordinator for 
Health IT under the Office of the Secretary and the formation of a 
public-private advisory body--the American Health Information 
Community--to advise HHS on achieving interoperability for health 
information exchange. The community, which is co-chaired by the 
Secretary of HHS and the former National Coordinator for Health IT, 
identified four breakthrough areas[Footnote 17] --consumer empowerment, 
chronic care, biosurveillance, and electronic health records--and 
formed workgroups intended to make recommendations for actions in these 
areas that will produce tangible results within a one- year period. 
Subsequently, in May 2006 the workgroups presented 28 recommendations 
to the American Health Information Community that address standards, 
privacy and security, and data-sharing issues. 

We also reported in March 2006[Footnote 18] that HHS--through the 
Office of the National Coordinator for Health IT--awarded $42 million 
in contracts that address a range of issues important for developing a 
robust health IT infrastructure, such as an increasing number of health 
care providers adopting electronic health records, definitions of 
health information standards being developed, architectural definitions 
for a national network, and the development and implementation of 
privacy and security policies. HHS intends to use the results of the 
contracts and recommendations from the American Health Information 
Community proceedings to define the future direction of a national 
strategy. In March, the National Coordinator told us that he intended 
to release a strategic plan with detailed plans and milestones later 
this year. The contracts are described in table 2. 

Table 2: Table 2: Health IT Contracts Awarded by HHS's Office of the 
National Coordinator: 

Contract: American Health Information Community Program Support; 
Date awarded: September 2005; 
Duration: 1 year; 
Cost: (in millions): $0.8; 
Description: To provide assistance to the National Coordinator in 
convening and managing the meetings and activities of the community to 
ensure that the health IT plan is seamlessly coordinated. 

Contract: Standards Harmonization Process for Health IT; 
Date awarded: September 2005; 
Duration: 1 year; 
Cost: (in millions): 3.2; 
Description: To develop and test a process for identifying, assessing, 
endorsing, and maintaining a set of standards required for 
interoperable health information exchange. 

Contract: Compliance Certification Process for Health IT; 
Date awarded: September 2005; 
Duration: 1 year; 
Cost: (in millions): 2.7; 
Description: To develop and evaluate a compliance certification process 
for health IT, including the infrastructure components through which 
these systems interoperate. 

Contract: Privacy and Security[A]; 
Date awarded: September 2005; 
Duration: 1Ĺ; years; 
Cost: (in millions): 17.5; (Increased by $6 million in August 2006 to 
include additional studies); 
Description: To assess and develop plans to address variations in 
organization-level business policies and state laws that affect privacy 
and security practices that may pose challenges to an interoperable 
health information exchange. 

Contract: Nationwide Health Information Network Prototypes; 
Date awarded: November 2005; 
Duration: 1 year; 
Cost: (in millions): 18.6; (4 contracts); 
Description: To develop and evaluate prototypes for a nationwide health 
information network architecture to maximize the use of existing 
resources such as the Internet to achieve widespread interoperability 
among software applications, particularly electronic health records. 
These contracts are also intended to spur technical innovation for 
nationwide electronic sharing of health information in patient care and 
public health settings. 

Contract: Measuring the Adoption of Electronic Health Records; 
Date awarded: September 2005; 
Duration: 2 years; 
Cost: (in millions): 1.8; 
Description: To develop a methodology to better characterize and 
measure the state of electronic health records adoption and determine 
the effectiveness of policies aimed at accelerating adoption of 
electronic health records and interoperability. 

Contract: Gulf Coast Electronic Digital Health Recovery; 
Date awarded: September 2005; 
Duration: 1 year; 
Cost: (in millions): 3.7; 
Description: To plan and promote the widespread use of electronic 
health records and digital health information recovery in the Gulf 
Coast regions affected by hurricanes last year. 

Source: HHS Office of the National Coordinator for Health Information 
Technology. 

[A] Jointly managed by the Agency for Healthcare Research and Quality 
and the Office of the National Coordinator. 

[End of table] 

HHS Is Continuing Efforts to Advance the Nationwide Implementation of 
Health IT and Complete a National Strategy: 

HHS and its Office of the National Coordinator for Health IT have made 
progress through the work of the American Health Information Community 
and several contracts in five major areas: (1) advancing the use of 
electronic health records, (2) establishing standards to facilitate the 
exchange of patient data, (3) defining requirements for the development 
of prototypes of the Nationwide Health Information Network, (4) 
incorporating privacy and security policy, practices, and standards 
into the national strategy, and (5) integrating public health into 
nationwide health information exchange. 

These activities and others are being used by the Office of the 
National Coordinator for Health IT to continue its efforts to complete 
a national strategy to guide the nationwide implementation of 
interoperable health IT. Since the release of its initial framework in 
2004, the office has taken additional steps to define a complete 
national strategy, building on its earlier work. However, while HHS has 
made progress in these areas, it still lacks detailed plans, 
milestones, and performance measures for meeting the President's goals. 

HHS Is Advancing the Use of Electronic Health Records: 

HHS has made progress toward advancing the adoption of electronic 
health records by defining initial certification criteria for 
ambulatory electronic health records. The Certification Committee for 
Health IT,[Footnote 19] which was awarded the Compliance Certification 
Process for Health IT contract, finalized functionality, security, and 
reliability certification criteria for ambulatory electronic health 
records in May 2006 and described interoperability criteria for future 
certification requirements. The committee subsequently certified 22 
vendors' electronic health records products in July. Its next phase is 
to define and recommend certification criteria for inpatient electronic 
health records. The committee plans to publish these criteria for 
public comment during the last quarter of 2006, with certification 
beginning in the second quarter of 2007. 

Additionally, the Nationwide Health Information Network contracts have 
thus far resulted in the identification of draft functional 
requirements for incorporating lab results and patient information, 
such as medical history and insurance information, into electronic 
health records. The requirements were presented to the Secretary of HHS 
in June 2006, and an initial set of requirements for the Nationwide 
Health Information Network are expected to be issued in September 2006. 

In our March 2006 testimony, we described the Gulf Coast Electronic 
Digital Health Recovery contract, which was awarded by HHS to promote 
the use of electronic health records to rebuild medical records for 
patients in the Gulf Coast region affected by hurricanes last year. The 
outcomes of the contract are expected to coordinate planning for the 
recovery of digital health information in cases of emergencies or 
disasters and to develop a prototype of health information sharing and 
electronic health records support. The contract established a task 
force of local and national experts to help area providers turn to 
electronic medical records as they rebuild medical records for their 
patients. 

HHS Has Initiated Steps to Establish Health IT Standards: 

HHS awarded its Standards Harmonization Process for Health IT contract 
to ANSI.[Footnote 20] The contract is supported by ANSI's Health IT 
Standards Panel, a collaborative partnership between the public and 
private sector. This effort integrates standards previously identified 
by the Consolidated Health Informatics[Footnote 21] and other federal 
initiatives. To date, the panel has selected 90 interoperability 
standards for areas such as electronic health records and public health 
detection and reporting. The selected standards specifically address 
components of the breakthrough areas defined by the American Health 
Information Community and were produced by accepted standards 
organizations. The Nationwide Health Information Network functional 
requirements also incorporate standards defined through the work of the 
Standards Harmonization Process for Health IT contract. The selected 
standards are currently being reviewed for acceptance by the Secretary. 

HHS has also involved the Department of Commerce's National Institute 
for Standards and Technology (NIST) with HHS's work to implement health 
IT standards through its standards harmonization contract. HHS's 
standards harmonization contractor is required to maximize the use of 
existing processes and collaborate with NIST where appropriate, 
including consideration of outputs from the standards harmonization 
process as Federal Information Processing Standards[Footnote 22] 
relevant to federal agencies. NIST's issuance of Federal Information 
Processing Standards for health IT is to be aligned with 
recommendations from public and private sector coordination efforts 
through the American Health Information Community, as accepted by the 
Secretary of HHS. The Federal Information Processing Standards are to 
be consistent with the standards adopted by the harmonization contract 
to enable the alignment of federal and private sector standards and 
widespread interoperability among health IT systems, particularly 
electronic health records systems. 

HHS Has Begun to Define Requirements for the Development of Prototypes 
for the Nationwide Health Information Network: 

HHS's Nationwide Health Information Network contracts are intended to 
provide architectures and prototypes of national networks based on the 
breakthrough areas defined by the American Health Information 
Community. HHS awarded contracts for developing these architectures and 
prototypes to four contractors. The contractors are to deliver final 
operating plans and prototypes of a national network that demonstrates 
health information exchange across multiple markets in November 2006. 

In late June 2006, HHS held its first Nationwide Health Information 
Network forum. More than 1000 functional requirements for a Nationwide 
Health Information Network were presented for discussion and public 
input. The requirements addressed general Nationwide Health Information 
Network infrastructure needs and the breakthrough areas defined by the 
American Health Information Community. The requirements are being 
reviewed by the National Committee for Vital and Health 
Statistics,[Footnote 23] which is expected to release its approved 
requirements by September 2006. 

HHS Is Taking Steps to Incorporate Privacy and Security Policies, 
Practices, and Standards into Its National Strategy: 

HHS, through its contracts and recommendations from the American Health 
Information Community and the National Committee for Vital and Health 
Statistics, has initiated several actions to address privacy and 
security issues associated with the nationwide exchange of health 
information. In May 2006, 22 states subcontracted under HHS's privacy 
and security contract to perform assessments of the impact of 
organization-level business policies and state laws on security and 
privacy practices and the degree to which they pose challenges to 
interoperable health information exchange. In August 2006, 11 more 
states and Puerto Rico were added to the scope of the contract. The 
outcomes of the contract are to provide a nationwide synthesis of 
information to inform privacy and security policy making at federal, 
state, and local levels. 

In addition, the standards selected through the standards harmonization 
contract include those that are applicable to the consumer empowerment 
breakthrough area, specifically privacy and confidentiality. Its 
initial standards are intended to allow consumers the ability to 
establish and manage permissions and access rights, along with informed 
consent for authorized and secure exchange, viewing, and querying of 
their medical information between designated caregivers and other 
health professionals. Additionally, the proposed functional 
requirements for the Nationwide Health Information Network include 
security requirements that are needed for ensuring the privacy and 
confidentiality of health information. 

In May 2006, several of the American Health Information Community 
workgroups recommended the formation of an additional workgroup 
comprised of privacy, security, clinical, and technology experts from 
each of the other American Health Information Community workgroups. The 
Confidentiality, Privacy, and Security Workgroup was formed in July to 
frame the privacy and security policy issues relevant to all 
breakthrough areas and solicit broad public input to identify viable 
options or processes to address these issues. The recommendations 
developed by this workgroup are intended to establish an initial policy 
framework and address issues including methods of patient 
identification, methods of authentication, mechanisms to ensure data 
integrity, methods for controlling access to personal health 
information, policies for breaches of personal health information 
confidentiality, guidelines and processes to determine appropriate 
secondary uses of data, and a scope of work for a long-term independent 
advisory body on privacy and security policies. The workgroup convened 
last month. 

In June 2006, the National Committee on Vital and Health Statistics 
presented to the Secretary of HHS a report recommending actions 
regarding privacy and confidentiality in the Nationwide Health 
Information Network. The recommendations cover topics that are, 
according to the committee, central to challenges for protecting health 
information privacy in a national health information exchange 
environment. Specifically, they address (1) the role of individuals in 
making decisions about the use of their personal health information, 
(2) policies for controlling disclosures across a national health 
information network, (3) regulatory issues such as jurisdiction and 
enforcement, (4) use of information by non-health care entities, and 
(5) establishing and maintaining the public trust that is needed to 
ensure the success of a national health information network. The 
recommendations are being evaluated by the American Health Information 
Community workgroups, the Certification Commission for Health IT, 
Health Information Technology Standards Panel, and other HHS partners. 
The committee intends to continue to update and refine its 
recommendations as the architecture and requirements of the network 
advance. 

HHS Is Continuing to Address Public Health Integration: 

To help promote the integration of public health data into a nationwide 
health information exchange, the American Health Information 
Community's biosurveillance workgroup made recommendations in May 2006 
intended to help the simultaneous flow of clinical care data to and 
among local, state, and federal biosurveillance programs. The community 
recommended that HHS develop sample data-use agreements and 
implementation guidance to facilitate the sharing of data from health 
care providers to public health agencies. The workgroup also 
recommended that HHS, in collaboration with privacy experts, state and 
local governmental public health agencies, and clinical care partners, 
develop materials to educate the public about the information that is 
used for biosurveillance including the benefits to the public's health, 
improved national security, and the protection of patient 
confidentiality by September 30, 2006. 

Information exchange standards for sharing clinical health information 
(e.g., emergency department visit data and lab results) with public 
health are included in the 90 standards recently recommended as a 
result of HHS's standards harmonization contract. The standards are 
intended to enable the transmission of essential ambulatory care and 
emergency department visit, utilization, and lab result data from 
electronic health care delivery and public health systems in 
standardized and anonymized[Footnote 24] format to authorized public 
health agencies within less than one day. In addition to advancing the 
use of electronic health records, the Gulf Coast contract is intended 
to help support public health emergency response by fostering the 
availability of field-level electronic health records to clinicians 
responding to disasters. 

HHS Is Continuing Efforts to Complete and Implement a National Strategy 
for Health IT: 

As called for by the President's executive order in April 2004, the 
national coordinator's office is continuing its efforts to complete a 
national strategy for health IT. Since we testified in March 2006, the 
office has worked to evolve the initial framework and, with guidance 
from the American Health Information Community, has revised and refined 
the goals and strategies identified in the initial framework. The new 
draft framework--The Office of the National Coordinator: Goals, 
Objectives, and Strategies--provides high-level strategies for meeting 
the President's goal for the adoption of interoperable health IT and is 
to be used to develop internal performance measures for the office's 
activities. 

The framework identifies objectives for accomplishing each of four 
goals, along with 32 high-level strategies for meeting the objectives. 
The Office of the National Coordinator has identified and prioritized 
the 32 strategies for accomplishing the framework's goals and has 
initiated 10 of them, which are supported by the contracts that HHS 
awarded in fall 2005. Table 3 illustrates the framework's goals, 
objectives, and strategies and identifies the 10 strategies that have 
been initiated. 

The Office of the National Coordinator has prioritized the remaining 22 
strategies defined in its framework. Six strategies are under active 
consideration, and the remaining 16 require future discussion. 
According to officials with the office, the strategies were prioritized 
based on guidance and direction from the American Health Information 
Community. The Office of the National Coordinator expects the framework 
to continue to evolve through collaboration among the Office of the 
National Coordinator and its partners, such as other federal agencies 
and the American Health Information Community, and as additional 
activities are completed through the contracts. 

Table 3: Office of the National Coordinator's Goals and Initial 
Objectives and Strategies: 

Goals: Goal 1: Inform health care professionals; 
Objectives: High-value electronic health records; 
High-level strategies: Simplify health information access and 
communication among clinicians[A]; 
Increase incentives for clinicians to use electronic health records[C]. 

Goals: Goal 1: Inform health care professionals; 
Objectives: Low-cost and low-risk electronic health records; 
High-level strategies: Foster economic collaboration for electronic 
health records adoption[B]; 
Lower total cost of electronic health records purchase and 
implementation[B]; 
Lower risk of electronic health records adoption[A]. 

Goals: Goal 1: Inform health care professionals; 
Objectives: Current clinical knowledge; High-level strategies: Increase 
investment in sources of evidence-based knowledge[C]; 
Increase investment in tools that can access and integrate evidence 
based knowledge in the clinical setting[C]; 
Establish mechanisms which will allow clinicians to empirically access 
information and other patient characteristics that can better inform 
their clinical decisions[C]. 

Goals: Goal 1: Inform health care professionals; 
Objectives: Equitable adoption of electronic health records; High-level 
strategies: Ensure low-cost electronic health records for clinicians in 
underserved areas[C]; 
Support adoption and implementation by disadvantaged providers[C]; 

Goals: Goal 2: Interconnect health care; 
Objectives: Widespread adoption of standards; 
High-level strategies: Establish well-defined health information 
standards[A]; 
Ensure federal agency compliance with health information standards[A]; 
Exercise federal leadership in health information standards 
adoption[A]. 

Goals: Goal 2: Interconnect health care; 
Objectives: Sustainable electronic health information exchange; 
High- level strategies: Stimulate private investment to develop the 
capability for efficient sharing of health information[B]; 
Use government payers and purchasers to foster interoperable electronic 
health information exchange[C]; 
Adapt federal agency health data collection and delivery to NHIN 
solutions[C]; 
Support state and local governments and organizations to foster 
electronic health information exchange[B]. 

Goals: Goal 2: Interconnect health care; 
Objectives: Consumer privacy and risk protections; 
High-level strategies: Support the development and implementation of 
appropriate privacy and security policies, practices, and standards for 
electronic health information exchange[A]; 
Develop and support policies to protect against discrimination from 
health information[C]. 

Goals: Goal 3: Personalize health management; 
Objectives: Consumer use of personal health information; 
High-level strategies: Establish value of personal health records, 
including consumer trust[B]; 
Expand access to personal health management information and tools[A]. 

Goals: Goal 3: Personalize health management; 
Objectives: Remote monitoring and communications; 
High-level strategies: Promote adoption of remote monitoring technology 
for communication between providers and patients[A]. 

Goals: Goal 3: Personalize health management; 
Objectives: Care based on culture and traits; 
High-level strategies: Promote consumer understanding and provider use 
of personal genomics for prevention and treatment of hereditary 
conditions[C]; 
Promote multi-cultural information support[C]. 

Goals: Goal 4: Improve population health; 
Objectives: Automated public health and safety monitoring and 
management; 
High-level strategies: Enable simultaneous flow of clinical care data 
to and among local, state, and federal biosurveillance programs[A]; 
Ensure that the nationwide health information network supports 
population health reporting and management[C]. 

Goals: Goal 4: Improve population health; 
Objectives: Efficient collection of quality information; 
High-level strategies: Develop patient-centric quality measures based 
on clinically relevant information available from interoperable 
longitudinal electronic health records[B]; 
Ensure adoption of uniform performance measures by health care 
stakeholders[C]; 
Establish standardized approach to centralized electronic data capture 
and reporting of performance information[C]. 

Goals: Goal 4: Improve population health; 
Objectives: Transformation of clinical research; 
High-level strategies: [Empty]. 

Goals: Goal 4: Improve population health; 
Objectives: Health information support in disasters and crises; 
High- level strategies: Foster the availability of field electronic 
health records to clinicians responding to disasters[A]; 
Improve coordination of health information flow during disasters and 
crises[C]; 
Support management of health emergencies[C]. 

Source: HHS Office of the National Coordinator for Health IT: 

[A] Strategy has been initiated: 

[B] Strategy is under active consideration: 

[C] Strategy requires future discussion: 

[End of table] 

While HHS has taken additional steps toward completing a national 
strategy and has initiated specific activities defined by its strategic 
framework, it still lacks the detailed plans, milestones, and 
performance measures needed to ensure that its goals are met. While the 
National Coordinator acknowledged the need for more detailed plans for 
its various initiatives and told us in March that HHS intended to 
release a strategic plan with detailed plans and milestones later this 
year, current officials with the office could not tell us when detailed 
plans and milestones would be defined. Given the complexity of the 
tasks at hand and the many activities to be completed, a national 
strategy that defines detailed plans, milestones, and performance 
measures is essential. Without it, HHS risks not meeting the 
President's goal for health IT. 

In summary, Mr. Chairman, our work shows that HHS is continuing its 
efforts to help transform the use of IT in the health care industry. 
However, much work remains. While HHS, through the Office of the 
National Coordinator for Health IT and the American Health Information 
Community, has initiated specific actions for supporting the goals of a 
national strategy, detailed plans and milestones for completing the 
various initiatives and performance measures for tracking progress have 
not been developed. Until these plans, milestones, and performance 
measures are completed, it remains unclear specifically how the 
President's goal will be met and what the interim expectations are for 
achieving widespread adoption of interoperable electronic health 
records by 2014. 

Mr. Chairman, this concludes my statement. I would be pleased to answer 
any questions that you or other Members of the Subcommittee may have at 
this time. 

Contacts and Acknowledgments: 

If you should have any questions about this statement, please contact 
me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Other individuals 
who made key contributions to this statement are Amanda C. Gill, Nancy 
E. Glover, M. Saad Khan, and Teresa F. Tucker. 

Abbreviations: 

HHS: Department of Health and Human Services: 
IT: information technology: 
NIST: National Institute for Standards and Technology: 

FOOTNOTES 

[1] Health IT is the use of technology to electronically collect, 
store, retrieve, and transfer clinical, administrative, and financial 
health information. 

[2] Executive Order 13335, Incentives for the Use of Health Information 
Technology and Establishing the Position of the National Health 
Information Technology Coordinator (Washington, D.C.: Apr. 27, 2004). 

[3] The American Health Information Community is a federally-chartered 
commission made up of representatives from both the public and private 
health care sectors. 

[4] In late 2005, HHS awarded several contracts to address a range of 
issues important for developing a health IT infrastructure, such as 
advancing the use of electronic health records, selecting health IT 
standards, developing prototypes of a national network, and defining 
privacy and security policies. 

[5] Ambulatory electronic health records are records of medical care 
that includes diagnosis, observation, treatment, and rehabilitation 
that is provided on an outpatient basis. Ambulatory care is given to 
persons who are able to ambulate, or walk about. 

[6] GAO, 21ST Century Challenges: Reexamining the Base of the Federal 
Government, GAO-05-325SP (Washington, D.C.: February 2005). 

[7] GAO, Information Technology: Benefits Realized for Selected Health 
Care Functions, GAO-04-224 (Washington, D.C.: Oct. 31, 2003). 

[8] Executive Order 13335. 

[9] This position was vacated by the first national coordinator in May 
2006. HHS is currently in the process of conducting a nationwide search 
for a new national coordinator and a deputy national coordinator. 

[10] Executive Order: Promoting Quality and Efficient Health Care in 
Federal Government Administered or Sponsored Health Care Programs 
(Washington, D.C.: Aug. 22, 2006). 

[11] GAO, Health Care: National Strategy Needed to Accelerate the 
Implementation of Information Technology, GAO-04-947T (Washington, 
D.C.: July 14, 2004). 

[12] GAO, Health Information Technology: HHS is Taking Steps to Develop 
a National Strategy, GAO-05-628 (Washington, D.C.: May 27, 2005). 

[13] GAO, Bioterrorism: Information Technology Strategy Could 
Strengthen Federal Agencies' Abilities to Respond to Public Health 
Emergencies, GAO-03-139 (Washington, D.C.: May 30, 2003); GAO, 
Information Technology: Federal Agencies Face Challenges in 
Implementing Initiatives to Improve Public Health Infrastructure, (GAO- 
05-308) Washington, D.C.: June 10, 2005). 

[14] GAO, Health Care: Continued Leadership Needed to Define and 
Implement Information Technology Standards, GAO-05-1054T (Washington, 
D.C.: Sept. 29, 2005). 

[15] These actions included the lack of mechanisms for better agency 
coordination of the various standards efforts, incomplete milestones 
associated with these efforts, and no mechanism to monitor the 
implementation of standards across the health care industry. 

[16] GAO, Health Information Technology: HHS is Continuing Efforts to 
Define a National Strategy, GAO-06-346T (Washington, D.C.: Mar. 15, 
2006). 

[17] Breakthrough areas are components of health care and public health 
that can potentially achieve measurable results in 2 to 3 years. 

[18] GAO-06-346T. 

[19] The Certification Committee for Health IT is a voluntary, private 
sector organization that is working to certify health IT products in 
three areas: ambulatory electronic health records for the office-based 
physician or provider, inpatient electronic health records for 
hospitals and health systems, and the network components through which 
the electronic health records operate and share information. 

[20] The American National Standards Institute is a private, nonprofit 
membership organization that coordinates the development and use of 
voluntary standards in the United States. 

[21] Consolidated Health Informatics was initiated in December 2001 as 
an Office of Management and Budget e-government project to establish 
federal health information standards to enable federal agencies to 
build interoperable health data systems. The project was incorporated 
into the Federal Health Architecture in September 2004. 

[22] Federal Information Processing Standards are developed by NIST in 
collaboration with national and international standards committees, 
users, industry groups, consortia, and research and trade organizations 
when there are no existing voluntary industry standards to address 
federal requirements for the interoperability of different systems, for 
the portability of data and software, and for computer security. 

[23] The National Committee on Vital and Health Statistics was 
established in 1949 as a public advisory committee that is statutorily 
authorized to advise the Secretary of HHS on health data, statistics, 
and national health information policy, including the implementation of 
health IT standards. 

[24] Anonymized data are data that have had personally identifying 
information removed. 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, 

NelliganJ@gao.gov 

(202) 512-4800 

U.S. Government Accountability Office, 

441 G Street NW, Room 7149 

Washington, D.C. 20548: