Health Information Technology - DHHS Steps to Address Privacy

Although advances in information technology (IT) can improve the quality and other aspects of health care, the electronic storage and exchange of personal health information introduces risks to the privacy of that information. HHS has not defined, as part of its approach, a process for ensuring that all privacy principles and challenges will be fully and adequately addressed. Given the large number and variety of activities being undertaken and the many federal, state, and private-sector entities contributing to the health IT initiatives, it is important that the department and its Office of the National Coordinator define a process for ensuring that all stakeholders’ contributions will be appropriately considered and that inputs to the privacy framework will be effectively assessed and prioritized to achieve comprehensive coverage of all privacy principles and challenges. In the absence of an overall approach that includes such a process, HHS faces the risk that privacy protection measures may not be consistently and effectively built into health IT programs, thus jeopardizing patient privacy as well as the public confidence and trust that are essential to the success of a future nationwide health information network. GAO recommends that HHS include in its overall privacy approach a process for assessing and prioritizing initiatives and the stakeholders’ needs to ensure that key privacy principles and challenges are completely and adequately addressed. Report Highlights Complete Report