HHS should lead on health IT privacy, security
Connecting state and local government leaders
The Health and Human Services Department needs to exert stronger leadership in determining how to apply privacy to health IT initiatives, according to the Government Accountability Office.
The Health and Human Services Department needs to exert stronger leadership in determining how to apply privacy to health IT initiatives. The agency is only in the early stages of privacy efforts and its plans are unclear, the Government Accountability Office said.
HHS needs a comprehensive approach as part of its national strategy for health IT, including detailed plans, milestones and mechanisms to monitor the progress of privacy and other health IT developments, said David Powner, GAO's director of IT Management Issues, in GAO's report and before lawmakers.
'Leadership is clearly needed. When we talk about an overall privacy approach, we discuss an entity responsible for pulling this together. The pulling together would involve making some of those tough policy decisions,' he said.
HHS is pursuing a collaborative approach to identify how to implement privacy protections for electronic health records and a nationwide health information network to share data securely, said Robert Kolodner, Interim National Coordinator for Health IT in HHS. Four groups recently demonstrated prototypes of how the nationwide health information network would exchange data.
'The milestones that are needed are not yet known,' he said at a recent hearing of the Senate Homeland Security and Government Affairs Subcommittee on Oversight of government Management, the Federal Workforce and the District of Columbia. His office has initiated a number of activities.
Results from one source or set of activities become input for another group; he said.
For example, a majority of the nation's governors are working together under HHS' contracted Health IT Privacy and Security Collaborative to examine variations in state privacy laws that could hinder the electronic exchange of health data over a nationwide health information network. HITPSC will report next month on their findings and recommend how to harmonize those differences.
'The idea of trying to figure out what those milestones will look like when we haven't received the report yet is something that, while we feel we can put something out there, may not have particular relationship with what we'll be executing in June, July or August,' Kolodner told lawmakers.
Although consensus is needed, and HHS is to be commended for its actions, including working with the private sector, the department still needs to come up with some milestones on how all this is going to come together, Powner said. Waiting too long means having to go back and retrofit electronic health record and other health IT systems that are being implemented.
HHS disagreed with GAO's recommendations and said that its collaborative and integrated approach would ensure privacy and security of health data within the nationwide health information exchange.
HHS has awarded several health IT contracts that include requirements for developing privacy and security. HHS' public-private advisory group, the American Health Information Community also has formed a Confidentiality, Privacy and Security Work Group to identify how to address privacy issues. Last month, AHIC recommended identity proofing processes with user authentication next. AHIC also will address data integrity, access control and confidentiality breaches.
The confidentiality and privacy work group also is using some of the recommendations from HHS' advisory National Committee for Vital Health Statistics to help guide and identify privacy requirements.
Protecting health data when it is shared among many providers and systems requires additional privacy and security than what the Health Insurance Portability and Accountability Act currently offers, said Sen. Daniel Akaka (D-HI), subcommittee chairman. More business parties will handle health data than what are covered under HIPAA.
'While more and more companies, providers and carriers move forward with health IT, I fear that privacy suffers while HHS takes time to decide how to implement privacy protection,' Akaka said, adding that HHS must address these issues in a more timely fashion.
The Office of Personnel Management, which provides health insurance for federal employees, requires its contracted health plans to comply with federal privacy requirements, said Daniel Green, deputy associate director of OPM's Center for Employee and Family Support Policy. OPM has encouraged its health carriers to implement health IT and provide quality and cost transparency and will require use of interoperability standards when they are set. OPM urged its carriers in its 2006 Call Letter, which provided its plans and guidance for this year, to offer electronic prescribing and personal health records to its consumers based on medical claims history, he said.
NEXT STORY: It's an 'exciting time' for authentication