GAO questions HHS efforts to secure electronic health records

张琨

February 05, 2007 (Computerworld) -- The U.S. Department of Health and Human Services (HHS) has not come up with a way to tie together the various initiatives it has ongoing to tackle the thorny privacy and security issues related to exchanging health care records electronically.

That concern is in a report released Thursday by the U.S. Government Accountability Office (GAO) that calls on HHS to define and put into place a comprehensive approach for protecting health information. Until it does that -- and identifies milestones for its approach -- the privacy and protection of personal health information exchanged through a nationwide network "will remain unclear," according to the report.

HHS disagreed with the GAO comments, the report said, arguing that it does have in place a "comprehensive and integrated approach for ensuring privacy and security of health information." In addition, HHS disagreed with the report's suggestion that it identify benchmarks for its work, noting that tightly scripted milestones "would impede HHS's processes and preclude stakeholder dialogue on the direction of important policy matters."

In addition to integrating its various privacy and security projects, the GAO recommended that HHS identify an entity who would be responsible for the integration of the privacy and security initiatives. HHS, however, did not comment on this suggestion, nor did it provide any information regarding any effort to assign responsibility for the activities, according to the report.

HHS officials did not respond to a request for comment on the GAO findings.

The report noted that HHS and its National Coordinator for Health IT have taken several steps to protect personal health information, including setting up two health information advisory committees and awarding several contracts that include requirements for addressing the privacy of health information exchanged nationwide.

张琨

NY Times' 'Warnings Over Privacy of U.S. Health Network' latest to question federal government's health information efforts


"The American Health Information Management Association (AHIMA) agrees with the basic premise maintained in recent news reports that more needs to be done in the federal government's effort to lead the way with sound policy to protect the privacy of patient health information as we move towards electronic health records and health information exchange. However, attention must be paid to the complexity of aligning the desires of 300 million Americans with the goals, objectives and needs of our nation's health care community, 50 state legislatures, governors, Congress and the Administration's healthcare policymakers.

"The AHIMA strongly supports the integration of privacy and security protections throughout the evolution of our healthcare information system. And while no one should expect fast answers and simple solutions in such a complex environment, much is being done to deliver to Americans an electronic health record system that secures individuals from misuse of personal health information, protects healthcare consumers' rights and meets their needs when they most need fast, accurate health information.

"AHIMA, our health information management professionals and our industry are all striving to work with providers, consumers, legislators and policy-makers at the state and national level to create and continually improve an environment that widely protects the confidentiality of health information; uses high, uniform standards of confidentiality and security to protect each health care consumer; does not tolerate the misuse of any personal health information and makes full use of health information technology and standards that ensures health information security and makes that secure health information available for the entire American population."