United States Government Accountability Office Report to Congressional Requesters ELECTRONIC April 2023 HEALTH INFORMATION EXCHANGE Use Has Increased, but Is Lower for Small and Rural Providers GAO-23-105540 April 2023 ELECTRONIC HEALTH INFORMATION EXCHANGE Use Has Increased, but Is Lower for Small and Rural Highlights of GAO-23-105540, a report to Providers congressional requesters Why GAO Did This Study What GAO Found Widespread adoption of electronic Electronic health information exchange is the ability to exchange medical records health information exchange has the and other health information electronically among health care providers and potential to improve health care quality between health care providers and patients. The Health Information Technology and reduce costs. While these goals for Economic and Clinical Health (HITECH) Act provided federal enhanced have been pursued for years, they Medicaid matching funds to states through 2021 to support certain efforts to have proved challenging to realize. advance electronic exchange. Nearly all states used these funds, and most have Through the HITECH Act, the federal identified other sources to sustain those efforts. government provided $2.4 billion to states to improve and advance certain Survey data show that the use of various electronic exchange methods among aspects of electronic health information hospitals and physicians has increased in recent years. However, GAO found exchange. that as of 2021, reported use among small and rural hospitals was lower than In light of this federal investment, GAO that of other hospitals. For example, see figure illustrating use by size of hospital. was asked to review health information Exchange Methods Often Used among Acute Care Hospitals by Size, 2021 exchange. This report describes (1) states' use of the HITECH funding for health information exchange efforts and their plans to replace those funds, (2) the extent to which use of electronic health information exchange has changed since the enactment of the HITECH Act, and (3) federal efforts that aim to address challenges to electronic health information exchange. GAO reviewed information and interviewed officials from ONC and the Centers for Medicare & Medicaid Services, the agency that administered the HITECH funding. GAO also conducted interviews with state agencies in eight states selected based on geographic variation and whether states accessed the HITECH funding for health information exchange, among other factors. In addition, GAO analyzed hospital and Stakeholders GAO interviewed noted that small and rural providers were less physician survey data, and interviewed likely to have the financial and technological resources to participate in or a range of stakeholders, including maintain electronic exchange capabilities. physicians and organizations representing physicians, as well as Federal efforts may address some impediments to electronic health information organizations representing hospitals, exchange. Specifically, the Trusted Exchange Framework and Common payers, health information exchange Agreement being implemented by the Office of the National Coordinator for organizations, and other industry Health Information Technology (ONC)-which aims to describe a common set of representatives. nonbinding principles to help facilitate exchange among health information networks-may mitigate costs providers face by providing a simpler approach to connecting with other providers. However, stakeholders noted that participation View GAO-23-105540. For more information, in this effort is voluntary and does not address issues like information technology contact Leslie V. Gordon at (202) 512-7114 or gordonlv@gao.gov. staffing shortages and gaps in broadband access that pose particular challenges to electronic exchange for small and rural providers. United States Government Accountability Office Contents Letter 1 Background 6 Nearly All States Used HITECH 90-10 Funding to Support Electronic Health Information Exchange, and Most Have Identified Other Funding for the Future 13 Use of Electronic Health Information Exchange Has Increased but Is Lower for Small and Rural Providers 17 HHS Efforts such as TEFCA May Address Some Persistent Impediments to Electronic Health Information Exchange 24 Agency Comments 29 Appendix I States' Use of HITECH Act 90-10 Funding for Health Information Exchange Activities 30 Appendix II GAO Contact and Staff Acknowledgments 32 Related GAO Products 33 Tables Table 1: Examples of Selected States' Use of Health Information Technology for Economic and Clinical Health (HITECH) Act 90-10 Funding for Health Information Exchange Efforts 14 Table 2: Number of States Receiving Health Information Technology for Economic and Clinical Health Act (HITECH Act) Health Information Exchange Funding that Reported Plans for Specific Activities 30 Figures Figure 1: Electronic Health Information Exchange Scenarios 8 Figure 2: Exchange Methods Often Used among Hospitals, by Characteristic, 2021 19 Figure 3: Exchange Methods Often Used by Hospitals in Selected States, 2021 21 Page i GAO-23-105540 Electronic Health Information Exchange Abbreviations AHA American Hospital Association CDC Centers for Disease Control and Prevention CMS Centers for Medicare & Medicaid Services EHR electronic health record HHS Department of Health and Human Services HIE organization health information exchange organization HIPAA Health Insurance Portability and Accountability Act of 1996 HITECH Act Health Information Technology for Economic and Clinical Health Act ONC Office of the National Coordinator for Health Information Technology TEFCA Trusted Exchange Framework and Common Agreement This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-23-105540 Electronic Health Information Exchange Letter 441 G St. N.W. Washington, DC 20548 April 21, 2023 The Honorable Brett Guthrie Chair The Honorable Anna Eshoo Ranking Member Subcommittee on Health Committee on Energy and Commerce House of Representatives The Honorable Michael C. Burgess, M.D. House of Representatives The Honorable Diana DeGette House of Representatives Widespread use of electronic health information exchange has the potential to improve the quality of health care provided in the United States while reducing health care costs. This electronic transmission of health information-such as health records, diagnoses, prescriptions, test results, and images-occurs among health care providers and between providers and patients. Electronic health information exchange can help ensure health care providers have the tools and clinical information they need to deliver more effective care, reduce medication errors and duplicative testing, and improve public health reporting and monitoring. While the goal of achieving widespread electronic health information exchange has been pursued for years, it has proved challenging to realize. A variety of methods are used to electronically exchange health information, including technology built into electronic health record (EHR) systems as well as different processes used by organizations that electronically move data among health care stakeholders (such as laboratories, public health departments, hospitals, and physicians), which are commonly referred to as health information exchange (HIE) organizations. We have previously reported on challenges associated with the various methods of exchange, including technical, financial, and legal challenges. For example, we have issued three reports in recent years that identified challenges related to matching patients to their Page 1 GAO-23-105540 Electronic Health Information Exchange records, the costs for updating or maintaining EHR systems, and navigating variation in state privacy laws. 1 Enacted in 2009, the Health Information Technology for Economic and Clinical Health (HITECH) Act provided about $35 billion to promote the development and adoption of health information technology. This included $2.4 billion in Medicaid payments paid to states through a matching formula toward their efforts to support, improve, and advance electronic health information exchange. 2 This funding sunsetted in 2021. Throughout this report we refer to these payments as HITECH 90-10 funding. In this report, we describe 1. how states used HITECH 90-10 funding for health information exchange efforts and states' plans to replace those funds; 2. the extent to which and how the use of electronic health information exchange has changed since the enactment of the HITECH Act; and 3. the federal efforts that aim to address key challenges to electronic health information exchange. To describe how states used HITECH 90-10 funding for health information exchange efforts and states' plans to replace those funds, we obtained information and interviewed officials from the Centers for Medicare & Medicaid Services (CMS) the agency within the Department of Health and Human Services (HHS) that administered the provision of HITECH 90-10 funding to the states. 3 Specifically, we obtained information on the funds to support health information exchange efforts 1See GAO, Health Information Technology: Approaches and Challenges to Electronically Matching Patients' Records across Providers, GAO-19-197 (Washington, D.C.: Jan. 15, 2019); Electronic Health Records: Nonfederal Efforts to Help Achieve Health Information Interoperability, GAO-15-817 (Washington, D.C.: Sept. 16, 2015); and Electronic Health Records: HHS Strategy to Address Information Exchange Challenges Lacks Specific Prioritized Actions and Milestones, GAO-14-242 (Washington, D.C.: Mar. 24, 2014) . 2 Pub. L. No. 111-5, § 4201, 123 Stat. 115, 489 (2009). States and the federal government share in the financing of the Medicaid program, with the federal government matching most state expenditures for Medicaid services on the basis of a statutory formula known as the Federal Medical Assistance Percentage. The HITECH Act authorized a federal payment of Federal Medical Assistance Percentage of 90 percent for states' costs related to reasonable administrative expenses and planning activities related to encouraging the adoption and use of certified EHR technology and the exchange of health care information among Medicaid providers. 3We use the term "states" to refer to the 50 states, District of Columbia, and five U.S. territories. Page 2 GAO-23-105540 Electronic Health Information Exchange and to sustain these efforts beyond the availability of the HITECH 90-10 funding. We also interviewed officials from the state agencies responsible for administrating the HITECH 90-10 funding in seven states about how HITECH 90-10 funds provided for health information exchange efforts were actually used, the operation of HIE organizations in those states, and how physicians in those states are exchanging health information. The states were selected to account for variation in geographic location, percent of hospitals connected to an HIE organization within the state, and whether the state accessed HITECH 90-10 funding to support health information exchange efforts, among other criteria. 4 We also conducted interviews with representatives from a total of 10 HIE organizations across the seven states. 5 We conducted interviews with stakeholders that included national health information exchange networks, consortiums of HIE organizations, and organizations representing providers, consumers, HIE organizations, payers, and information technology professionals. 6 To describe the extent to which and how the use of electronic health information exchange has changed since the enactment of the HITECH Act, we reviewed data and reports from two national surveys. • We reviewed data briefs on hospital use of electronic health exchange published by HHS's Office of the National Coordinator for Health Information Technology (ONC) based on its analysis of annual data from the 2014 through 2020 American Hospital Association (AHA) Survey Information Technology Supplement of acute care hospitals. 7 4The seven states were: Colorado, Georgia, Maryland, Minnesota, Missouri, Oklahoma, and Washington. 5We interviewed one HIE organization per state in Maryland, Minnesota, Oklahoma, and Washington. We interviewed two HIE organizations per state in Colorado, Georgia, and Missouri. 6Throughout our report, we collectively refer to all of the interviewees as "stakeholders" unless otherwise specified. 7Acute care hospitals provide inpatient medical care and other related services for surgery, acute medical conditions or injuries, usually for a short-term illness or condition. All 6,165 acute care hospitals in the U.S. were surveyed, of which 2,871 responded. According to ONC officials, due to pandemic-related delays, the 2020 AHA Survey Information Technology Supplement survey (which is a supplement to the 2020 AHA Survey) was not fielded on time. It was fielded from April 2021 through September 2021 and instructed respondents to answer questions as of the day the survey was completed. Therefore, these data represent hospitals' experiences in 2021 rather than 2020. Page 3 GAO-23-105540 Electronic Health Information Exchange We also obtained data from the 2020 survey to conduct additional national and state-level analyses focused on, among other things, the methods hospitals reported using to exchange health information. 8 • We also reviewed results from the National Electronic Health Records Survey from 2018, 2019, and 2021 focused on office-based physicians' use of electronic health information exchange. 9 • We conducted interviews with, or obtained written responses from, AHA and officials from ONC and the Centers for Disease Control and Prevention (CDC) to learn about these data and their limitations and determined they were reliable for the purposes of our reporting objectives. We also conducted interviews with state agencies in eight states-the seven previously selected states plus New Hampshire, which did not access HITECH 90-10 funding-and the 10 HIE organizations to learn about the methods of exchange used in these states. We interviewed 12 physicians in six of our selected states and provider associations in two of our selected states to learn about the methods they have used to exchange health information. We identified these physicians through outreach to the American Medical Association and state provider associations affiliated with the American Medical Association, the American Academy of Family Physicians, and the American College of Physicians. 10 Interviews with physicians allowed us to identify concrete examples, but these examples only reflect the experiences of those physicians and are not intended to be generalizable. 8According to AHA, these were the most recently available data at the time of our review. The response rate for the most recent AHA Annual Survey Information Technology Supplement was 47 percent. Findings from this survey may not be generalizable to all hospitals (e.g., hospitals with limited information technology infrastructure), but they illustrate experiences from a variety of hospitals. 9The National Electronic Health Records Survey is an annual survey conducted by the National Center for Health Statistics within the Centers for Disease Control and Prevention (CDC). Data from 2018, 2019, and 2021 were the most recent available. According to CDC officials, the survey was not conducted in 2020. Unweighted response rates for the CDC surveys ranged from 36 percent to 47 percent from 2018 to 2021. Findings may not be generalizable to all office-based physicians, but they illustrate different physician experiences. 10We contacted state provider associations in all eight states to identify physicians to interview, but we were unable to identify physicians to interview in two states. Page 4 GAO-23-105540 Electronic Health Information Exchange To describe the key challenges that continue to affect electronic health information exchange and the federal efforts to address these challenges, we reviewed past GAO work on this topic, related federal laws and regulations, and the Trusted Exchange Framework and the Common Agreement (TEFCA) published by ONC, as required by the 21st Century Cures Act. 11 We also reviewed data from both the 2020 AHA Annual Survey Information Technology Supplement and the National Electronic Health Records Survey from 2018 and 2019 on the challenges to electronic health information exchange reported by hospitals and physicians, respectively. 12 In all interviews conducted with state agency officials, representatives of HIE organizations, physicians, and other stakeholders, we asked about whether they encountered or were aware of challenges that affected electronic health information exchange. We also conducted interviews with officials or obtained written responses from CDC, CMS, and ONC about the implementation of TEFCA and other federal efforts, and the potential of these efforts to address the challenges identified in the course of our review. In addition, in our interviews with an industry expert and stakeholder organizations, we sought input on how federal efforts might address the challenges identified. 13 Finally, to inform all three objectives, we conducted a literature search to identify articles published between January 1, 2021 and April 21, 2022 that discussed electronic health information exchange. 14 We conducted this performance audit from November 2021 to April 2023 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain 11Pub. L. No. 114-255, § 4003(b), 130 Stat. 1033, 1165 (2016). TEFCA aims to describe a common set of nonbinding, foundational principles for trust policies and practices that can help facilitate exchange among health information networks. 12The 2021 National Electronic Health Records Survey did not include questions about barriers to health information exchange. 13TEFCA had not been implemented at the time of our work. Therefore, stakeholders we interviewed were only able to comment on what they anticipated the effect of TEFCA might be once it was fully implemented. 14We searched for a number of phrases starting with "health information exchange" and with permutations using terms such as "rural health," "rural," "electronic health record," and "HITECH Act." The search resulted in 172 references, which included scholarly or peer reviewed material, conference proceedings, congressional hearings, reports, dissertations, and books. Results were used as contextual information, specifically regarding what we heard during interviews. Of the 172 references reviewed, we used 54 for our purposes. Page 5 GAO-23-105540 Electronic Health Information Exchange sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background Methods of Electronic Electronic health information exchange can occur through a variety of Health Information organizations and methods. 15 Common organizations that facilitate Exchange exchange include state, regional, or local HIE organizations and national networks. Common methods used for exchange include software solutions developed by private companies, such as those that support EHR technology, EHR products, or interfaces developed to connect different systems to each other, and electronic communications, such as secure messaging and event notifications. 16 • State, regional, or local HIE organizations. HIE organizations are entities that electronically move data among health care stakeholders, such as laboratories, public health departments, hospitals, and physicians. This exchange can be facilitated at the state, regional, or local level, depending on the structure of each of the organizations. For example, some states have one or more HIE organizations that facilitate health information exchange statewide or for specific areas 15In HHS regulation, ONC defines both a "health information exchange" and a "health information network." See 45 C.F.R. §171.102. The HHS definition states that a health information exchange or health information network means an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of any technology or services for access, exchange, or use of electronic health information: (1) Among more than two unaffiliated individuals or entities that are enabled to exchange with each other; and (2) That is for a treatment, payment, or health care operations purpose, as such terms are defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regardless of whether such individuals or entities are subject to the requirements of HIPAA. 16EHR technology is a type of health information technology used by healthcare providers to create, store, and share electronic records of patient health information. The HITECH Act established a definition for a "qualified EHR" (which ONC adopted as a "Base EHR" in 45 C.F.R. § 170.102) identifying key capabilities including to record and display patient demographic and clinical health information, such as medical history and problem lists; to provide clinical decision support; to support physician order entry; to capture and query information relevant to health care quality; and to exchange electronic health information with, and integrate such information from, other sources. EHR technology that meets such a definition may be a combination of interconnected EHR products or a single EHR product that supports the capabilities. Page 6 GAO-23-105540 Electronic Health Information Exchange of a state. In another example, an HIE organization may facilitate exchange for multiple states in a region of the country. • National health information exchange networks. These national networks include multi-EHR developer networks, which can be used to exchange health information among EHR technologies or products connected to each other or HIE organizations. A national network can facilitate query-based data exchange and enable connectivity by providing the routing technology between and among existing health information technology data exchange programs and platforms. • EHR developer networks. In addition to electronically storing a patient's health information entered by the patient's provider, EHR developers may include functionality that facilitates the electronic exchange of health information with other health care providers across a network. These networks are generally developed to exchange information between providers using an EHR system from the same EHR developer. EHR developer networks may also be referred to as EHR vendor-based networks. • Point-to-point interfaces. Health care providers may have customized interfaces developed to allow them to exchange patient health information with specific providers or HIE organizations that may or may not use the same EHR product. Such interfaces generally only allow for exchange with a single entity outside of the provider's organization. • Secure messaging. Secure messaging describes methods used by health care providers and others to directly and securely send or receive health information. There are different methods and approaches for secure messaging, including the use of encryption. Secure messaging capabilities may be included within EHR products, or providers can access it as a separate service. • Event notifications. These notifications may be generated by an HIE organization and notify providers, sometimes in real time, of patient interactions within the health care system. Such alerts can be customized to be triggered for a defined event, such as the admission, discharge, or transfer of a patient, or for a specific list of patients meeting certain criteria (e.g., all patients in a practice who have a diagnosis of heart failure). Electronic health information exchange can occur in a variety of contexts and settings. See figure 1 for examples. Page 7 GAO-23-105540 Electronic Health Information Exchange Figure 1: Electronic Health Information Exchange Scenarios Page 8 GAO-23-105540 Electronic Health Information Exchange Longstanding Challenges We and others have previously reported on a number of challenges to to Electronic Health electronic health information exchange, including technical and financial challenges, as well as challenges related to variation in privacy laws. 17 Information Exchange • Technical challenges. In prior work, we reported on insufficiencies in health data standards, a lack of implementation and adoption of standards for EHR and other health IT technologies, and difficulties with accurately matching patients' health records. 18 If the same sets of standards are adopted by multiple different systems, it can facilitate the exchange and interoperability of health information. 19 However, variation in standards across systems can make electronic exchange and interoperability of information exchanged between systems difficult or even impossible, as data transmitted cannot be read by systems receiving the information. For example, if a standard is implemented by one health IT developer such that it records or formats information differently from the way another developer formats that information, it can result in providers using those two different systems being unable to electronically exchange information with each other. While some of the variation in how information is formatted may be determined by developers, some may result from requests made by providers for customization of their EHR technology. In addition, because providers use different methods to identify patients, a provider can encounter problems matching information received from another provider to the correct patient. Difficulty matching patients to their records can occur when exchanging health information if, for example, demographic 17See GAO-19-197, GAO-15-817, and GAO-14-242. 18Standards are agreed-upon methods for connecting systems together. Standards may pertain to security, data transport, data format or structure, or the meanings of codes or terms. Health data standards are those that pertain to health-related information, specifically. 19EHR interoperability refers to the ability of EHR systems to exchange electronic health information with other systems and process the information without special effort on the part of the user, such as a health care provider. When EHR systems are interoperable, information can be exchanged-sent from one provider to another-and then seamlessly integrated into the receiving provider's EHR system, allowing the provider to use that health information to inform clinical care. Page 9 GAO-23-105540 Electronic Health Information Exchange information used to match records is not consistently captured in all records for a patient. 20 • Financial challenges. Our prior work has identified how the high costs for purchasing an EHR system as well as EHR customization, upgrades, and updates, and for legal fees can create barriers to electronic health information exchange. 21 • Challenges related to state privacy laws. Our prior work and other research have reported that the variation in state privacy rules, such as those pertaining to patient consent for sharing health information, created challenges for electronic health information exchange. 22 Navigating these laws can complicate the exchange of health information across state borders. Various state laws govern the disclosure of health information and may require a patient's permission before disclosing certain categories of information. Certain providers may be subject to these state privacy laws in addition to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. 23 20Information such as a patient's name, date of birth, phone number, or address may be captured differently among providers. For example, one provider's record may include both first and middle name, while another's may only include first name, or one may include an outdated mailing address, and so on. If every provider does not capture this demographic information in the same format, it may be difficult or impossible to match patients' records. See GAO-19-197, GAO-15-817, and GAO-14-242. See also D. Pai, B. Rajan, and S. Chakraborty, "Do EHR and HIE Deliver on Their Promise? Analysis of Pennsylvania Acute Care Hospitals," International Journal of Production Economics, vol. 245 (2021). 21See GAO-15-817 and GAO-14-242. 22See GAO-15-817 and GAO-14-242. See also L. Lenert and B. Yeager McSwain, "Balancing Health Privacy, Health Information Exchange, and Research in the Context of the COVID-19 Pandemic," Journal of the American Medical Informatics Association, vol. 27, no. 6 (2020): 963-966; N. Apathy and A. Holmgren, "Opt-in Consent Policies: Potential Barriers to Hospital Health Information Exchange," American Journal of Managed Care, vol. 26, no. 1 (July 1, 2020). 23HIPAA provides for the creation, enforcement, and monitoring of information security and privacy standards for electronic health data. Pub. L. No. 104-191, Title II, Subtitle F, 110 Stat. 1936, 2021 (1996) as amended by the HITECH Act, Pub. L. No. 111-5, Title XIII, 123 Stat. 115, 226 (Feb. 17, 2009). The HIPAA Rules refer to regulations that implement HIPAA promulgated at 45 C.F.R. Parts 160 and 164-the Privacy, Security, Enforcement, and Breach Notification Rules. These regulations establish national standards to protect individuals' medical records and other individually identifiable health information. The Privacy Rule sets limits and conditions on the use and disclosures of information that may be made without an individual's authorization. Page 10 GAO-23-105540 Electronic Health Information Exchange Federal Efforts in Health The HITECH Act included a number of provisions to authorize funding Information Exchange and promote efforts to facilitate electronic health information exchange. These included authorization of federal Medicaid matching funds for electronic health information exchange activities and the Medicare and Medicaid Electronic Health Record Incentive Programs. The federal Medicaid matching funds, known as HITECH 90-10 funding, provided funding to states at a 90-10 matching level (i.e., $90 federal dollars for every $10 spent by the state). States could use these funds to support health information exchange activities related to the Medicaid Electronic Health Record Incentive Program, such as to design, develop, or implement tools to connect HIE organizations; facilitate electronic lab reporting; establish connections with immunization registries; fund HIE organizations; and develop technical bridges between Medicaid systems and HIE organizations. 24 This funding, which sunsetted in 2021, was not intended to be the sole or primary source of funding for health information exchange efforts. Before requesting these funds, states were required to submit implementation plans to CMS that describe the health information exchange efforts they anticipated supporting with these funds, anticipated budgets for these efforts, and how they would sustain these efforts beyond the availability of the HITECH 90-10 funding. 25 The Medicare and Medicaid Electronic Health Record Incentive Programs were established in 2011 and provided incentive payments for certain providers, such as eligible hospitals and physicians, to encourage them to adopt, implement, and upgrade certified EHR technology to demonstrate meaningful use of health information technology. 26 According to CMS, a total of $28.7 billion in federal funds was provided in incentive payments and for administrative costs related to these programs. Medicare providers were eligible to receive incentive payments through 2016, and 24We refer to this 90-10 Medicaid federal financial participation funding as HITECH 90-10 funding throughout this report. 25See 45 C.F.R. §95.610. These implementation plans, referred to as Advanced Planning Documents, are recorded plans of action to request federal funding approval for an IT project supporting the Medicaid program. States can also use Advanced Planning Documents to, for example, request that CMS review a contract or reallocate funds from a preceding to a current fiscal year. CMS issued State Medicaid Director Letters #11-004 and #10-016, which include guidance on the types of health information exchange activities for which states were able to request HITECH 90-10 administrative funding. 26CMS and ONC have established standards and other criteria for structured data that EHRs must meet. Structured data allows health care providers to easily retrieve and transfer patient information and use the EHR in ways that can aid patient care. Page 11 GAO-23-105540 Electronic Health Information Exchange Medicaid providers were eligible through 2021. In 2018, CMS renamed this effort the Medicare and Medicaid Promoting Interoperability Programs. Participation was optional, but successful participants could receive a payment adjustment based on their participation score. In 2022, the Medicaid Promoting Interoperability Program ended, and the Medicare Promoting Interoperability Program remains. The 21st Century Cures Act of 2016 directed ONC to develop or support a trusted exchange framework, including a common agreement among health information networks nationally. TEFCA describes a common set of nonbinding principles that can help facilitate exchange among health information networks. 27 ONC, the federal agency implementing TEFCA, aims for TEFCA to simplify connectivity for entities in order to increase the electronic exchange of health information. Through TEFCA, ONC has established Qualified Health Information Networks, organizations that will connect directly to one another to facilitate the exchange of health information among participants, which can include HIE organizations, providers, and health systems. According to ONC, TEFCA is in the process of being implemented by ONC and a Recognized Coordinating Entity. 28 27The Cures Act amended the Public Health Service Act to include this direction to ONC. 42 U.S.C. § 300jj-11(c). 28In2019, ONC awarded a cooperative agreement to the Sequoia Project to serve as the Recognized Coordinating Entity for TEFCA. The Recognized Coordinating Entity is responsible for developing, implementing, and maintaining the Common Agreement. In conjunction with ONC, the Recognized Coordinating Entity will also designate and monitor Qualified Health Information Networks. The Common Agreement is a legal contract that ONC's Recognized Coordinating Entity, the Sequoia Project, will sign with each Qualified Health Information Network. Page 12 GAO-23-105540 Electronic Health Information Exchange Nearly All States Used HITECH 90-10 Funding to Support Electronic Health Information Exchange, and Most Have Identified Other Funding for the Future Nearly All States Used According to CMS, 51 states used HITECH 90-10 funding to support HITECH 90-10 Funding to efforts related to electronic health information exchange. 29 CMS reported Support Electronic that the plans submitted for how this funding would be used generally included similar efforts, such as connecting providers with HIE Exchange Efforts and organizations (known as onboarding); supporting infrastructure for Fund HIE Organizations electronic exchange, such as secure messaging; supporting public health efforts; and supporting health information exchange services, such as event notifications. See appendix I for more details on the plans submitted by the 51 states. Of the seven states in our review that accessed HITECH 90-10 funding, officials from five states reported using some or all of the funds to pay HIE organizations operating in their states to carry out health information exchange activities, such as connecting providers to HIE organizations or establishing exchange for public health efforts. See table 1 for more details on how the seven states used these funds. 29We use the term "states" to refer to the 50 states, District of Columbia, and five U.S. territories. Illinois, New Hampshire, South Carolina, American Samoa, and Northern Mariana Islands did not access this HITECH 90-10 funding. Page 13 GAO-23-105540 Electronic Health Information Exchange Table 1: Examples of Selected States' Use of Health Information Technology for Economic and Clinical Health (HITECH) Act 90-10 Funding for Health Information Exchange Efforts Some or all of the funding paid to HIE State Examples of health information exchange activities funded with HITECH 90-10 funding organizations? Colorado • Connected providers with and developing inoperability between health information Yes (some) exchange (HIE) organizations • Connected providers and others to public health registries • Supported efforts related to consent management • Funded Governor's Office of eHealth Innovation Georgia • Conducted Electronic Health Record Incentive Program audits Yes (some) • Conducted Medicaid provider outreach • Developed query-based exchange services • Conducted planning and development activities for health information exchange efforts • Implemented secure messaging Maryland • Supported the development of clinical query portal Yes (all) • Established encounter notification service to notify providers when a patient has been hospitalized in any regional hospital • Established public health reporting Minnesota • Established encounter notification service to notify providers when a patient has been No hospitalized • Established connectivity with public health agency for public health reporting efforts Missouri • Funded development of a statewide health information highway Yes (all) • Provided onboarding assistance to help providers connect to HIE organizations in the state Oklahoma • Implemented a provider onboarding program Yes (all)a • Established a provider portal • Established exchange capabilities with the state's Department of Health Washington • Built interfaces to facilitate health information exchange between health care providers No and other entities • Funded behavioral health data exchange efforts • Expanded access for rural health care providers • Supported provider onboarding to a clinical data registry • Supported data exchange with state immunization registry • Modernized state health IT systems. Source: GAO review of Centers for Medicare & Medicaid Services documents and interviews with state agency officials. | GAO-23-105540 a In 2021, Oklahoma contracted with a technology vendor, which was expected to serve as the statewide HIE organization, to carry out these activities. According to state officials, all of the state's HITECH 90-10 funding for health information exchange-related efforts was expended on this contract. However, in 2021, another organization already in operation was designated to operate as the statewide HIE organization. Stakeholders we interviewed-including state agency officials, representatives from HIE organizations, and groups representing HIE Page 14 GAO-23-105540 Electronic Health Information Exchange organizations-described the HITECH 90-10 funding as critical for establishing and supporting the development of HIE organizations around the country. In addition, studies we reviewed found that most HIE organizations were established after the enactment of the HITECH Act, and that the HITECH 90-10 funding was significant both for establishing HIE organizations and motivating providers to work with HIE organizations to exchange health information. 30 Most States Have According to information provided by CMS, 50 of the 51 states that Identified Other Funding accessed HITECH 90-10 funding for health information exchange efforts have identified other potential funding sources to sustain those efforts Sources to Sustain Health following the sunsetting of the HITECH 90-10 funding in 2021. CMS Information Exchange officials reported that as of December 2022, 29 of the 51 states had Efforts Formerly Funded already requested Medicaid Enterprise Systems funding. 31 State agency by HITECH officials in all seven states we reviewed that had received HITECH 90-10 funds stated that they were either already receiving or were in the process of applying for Medicaid Enterprise Systems funds as a means for sustaining health information exchange efforts formerly funded through HITECH. States reported to CMS that they will pursue a variety of other approaches to sustain health information exchange efforts previously funded by HITECH 90-10 funding, including provider or payer subscription fees, state funding, grants, or donations. State officials, representatives from HIE organizations, and other stakeholders we interviewed also described various approaches to sustaining these efforts. For example, HIE organizations and state agencies stated that 30H. Atasoy, E. Demirezen, and P. Chen, "Impacts of Patient Characteristics and Care Fragmentation on the Value of HIEs," Production and Operations Management, vol. 30, no. 2 (Feb. 2021); E. Nahm et al, "Health Information Exchange: Practical Overview and Implications for Nursing Practice," The Journal of Nursing Administration, vol. 50, no. 11 (Nov. 2020): 584-589; J. Pendergrass and C. Ranganathan, "Institutional Factors Affecting the Electronic Health Information Exchange by Ambulatory Providers," Health Policy and Technology, vol. 10, no. 4 (Oct. 9, 2021). 31Medicaid Enterprise Systems funding is federal funding provided to states to support modular, flexible, upgradeable systems for state Medicaid agencies and their users for activities such as reporting and fraud detection, checking beneficiary eligibility, and Medicaid beneficiary care management. CMS determined that states were able to request Medicaid Enterprise Systems funding for some efforts previously supported through HITECH Act funding for HIE-related activities. In addition, one territory (Northern Mariana Islands) and one state (New Hampshire) that had not requested HITECH 90-10 funds for health information exchange efforts requested Medicaid Enterprise Systems funds for these purposes. Page 15 GAO-23-105540 Electronic Health Information Exchange they planned to pursue or were already accessing other state or federal funding to support exchange activities. They also said they planned to charge or were already charging subscription fees for providers, researchers, and state agencies to use their health information exchange services as a way to sustain activities previously funded under HITECH. In addition, some HIE organizations described plans to use subscription fees from commercial payers to help sustain health information exchange activities; in exchange, those payers would obtain access to certain health information or electronic exchange services. HIE organizations have also described taking steps to maintain their operations. A group representing HIE organizations and studies we reviewed noted that HIE organizations need to offer additional services of value to their customers in order to be sustainable. 32 Officials we interviewed from HIE organizations described how they are providing services that include data analytics, data exchange connections with public health entities, connections with social service referral agencies, and data for payers to use in claims processing. In addition, representatives we interviewed from five HIE organizations stated that they had either recently merged with another HIE organization or were planning to do so as a means to sustain their operations. Stakeholders described how merging with other HIE organizations allowed or would allow them to save money through the consolidation of technical infrastructure or legal staff. Finally, several stakeholders described how HIE organizations are pursuing a health data utility model as a way to be an entity that provides more than just the exchange of clinical data between providers. Under this type of model, HIE organizations would combine, enhance, and exchange electronic health data across care and service settings for treatment, care coordination, quality improvement, and public and community health purposes through specific, defined use cases in accordance with applicable state and federal laws protecting patient privacy. 32N. Yaraghi, S. Lai, "Maintaining Health Information Exchange Competitiveness in a New Market." Brookings Institute, (Oct. 7, 2021); J. Adler-Milstein et al, "A Survey of Health Information Exchange Organizations In Advance of a Nationwide Connectivity Framework," Health Affairs, vol. 40, no. 5 (May 2021). Page 16 GAO-23-105540 Electronic Health Information Exchange Use of Electronic Health Information Exchange Has Increased but Is Lower for Small and Rural Providers While Electronic Exchange National surveys of both hospitals and office-based physicians have Has Increased, Use shown increases in the electronic sending and receiving of patient health information in recent years. For example, according to ONC analyses of among Small and Rural AHA Annual Survey Information Technology Supplement survey data, the Hospitals and Office- percentage of hospitals that reported either "sometimes" or "often" using Based Physicians Was electronic methods to send patient health information increased from 78 Lower percent in 2014 to 91 percent in 2021, and the percentage that reported either "sometimes" or "often" receiving patient information electronically increased from 56 percent in 2014 to 85 percent in 2021. 33 Similarly, according to weighted results of the National Electronic Health Records Survey of office-based physicians reported by the CDC, the percentage of physicians that reported they electronically send patient health information to providers outside of their medical organization using an EHR product or web portal (separate from their EHR product) increased from 29 percent in 2018 to 39 percent in 2021, and the percentage that reported receiving patient health information that way increased from 34 percent in 2018 to 53 percent in 2021. Stakeholders we interviewed also described how the electronic exchange of health information has increased over time, with providers now generally having multiple methods available to them-such as HIE organizations, EHR developer networks, event notifications, and log-in credentials for hospitals' or health systems' EHRs. Some stakeholders noted improvements in the ability to exchange directly between EHR systems when providers had the same EHR product. Some also noted 33According to ONC officials, the 2020 AHA Annual Survey Information Technology Supplement was fielded from April 2021 to September 2021. Respondents were asked to answer the survey questions as of the day the survey was completed, which included their experiences from 2020. Responses were based on the frequency with which a hospital used the various exchange methods, and these were: often, sometimes, rarely, never, and do not know/NA. ONC's analysis of these data was reported in a data brief issued in 2023. See Y. Pylypchuk and J. Everson, "Interoperability and Methods of Exchange among Hospitals in 2021," ONC Data Brief, no. 64, Office of the National Coordinator for Health Information Technology (Washington, D.C.: Jan. 2023). Page 17 GAO-23-105540 Electronic Health Information Exchange that electronic exchange was occurring more among large hospitals or health systems and physicians affiliated with large hospitals or health systems. In addition, some stakeholders noted that providers, including physicians, often use multiple forms of both electronic and non-electronic exchange, and that the methods of exchange they use are often affected by factors such as whether they are connected to an HIE organization, the electronic capabilities of organizations they exchange information with, and the information being exchanged. While there were overall increases in the use of electronic exchange, including among small and rural hospitals, our analysis of the AHA Survey Information Technology Supplement data found that, as of 2021, small hospitals' and rural hospitals' reported use of electronic methods of health information exchange lagged behind larger and non-rural hospitals. 34 While ONC reported that electronic exchange had increased among small hospitals and rural hospitals in recent years, it noted that these providers continue to engage in electronic exchange at rates lower than larger and non-rural hospitals. 35 Furthermore, our review of these data found that the percentages of small hospitals that reported "often" using an HIE organization, EHR vendor-based network, or national network to electronically exchange health information were less than the percentages reported by medium and large hospitals. 36 In addition, the percentage of rural hospitals that reported they "often" used fax or mail to exchange patient health information was higher than the percentage reported by non-rural hospitals (see fig. 2). 34"Smallhospitals" refers to hospitals with bed sizes of 100 or less. Rural hospitals are those hospitals located in a non-metropolitan statistical area. 35Y. Pylypchuk and J. Everson, "Interoperability and Methods of Exchange among Hospitals in 2021," ONC Data Brief, no. 64, Office of the National Coordinator for Health Information Technology (Washington, D.C.: Jan. 2023). 36Responses were based on the frequency with which a hospital used the various exchange methods, and these were: often, sometimes, rarely, never, and do not know/NA. Page 18 GAO-23-105540 Electronic Health Information Exchange Figure 2: Exchange Methods Often Used among Hospitals, by Characteristic, 2021 Note: Of the 6,165 acute care hospitals in the U.S. that were surveyed, 2,871 responded to the 2020 American Hospital Association Annual Survey Information Technology Supplement. According to ONC officials, due to pandemic-related delays, the 2020 AHA Survey Information Technology Supplement survey (which is a supplement to the 2020 AHA Survey) was not fielded on time. It was fielded from April 2021 through September 2021 and instructed respondents to answer questions as of the day the survey was completed. Therefore, these data represent hospitals' experiences in 2021 rather than 2020. Responses were based on the frequency with which a hospital used the various exchange methods, and these were: often (as shown in the figure), sometimes, rarely, never, and do not know/NA. Findings from this survey may not be generalizable to all hospitals (e.g., hospitals with limited information technology infrastructure), but they illustrate experiences from a variety of hospitals. Stakeholders noted that small and rural providers, as well as those not affiliated with a large hospital or health system, were less likely to have the financial or technological resources to participate in an HIE Page 19 GAO-23-105540 Electronic Health Information Exchange organization or purchase or maintain an EHR system capable of electronic exchange. As a result, some noted that such providers were more likely to rely on mail or fax to exchange patient information than electronic methods. All 12 physicians we interviewed said they used fax to send or receive patients' health information. Of those, 11 physicians said they often used fax rather than electronic methods to exchange patient health information, including one physician whose practice was also connected to an HIE organization and an EHR developer network. The twelfth physician noted using an EHR developer network to exchange information and only using fax with other providers who did not have the same EHR developer. Hospitals' Use of Hospitals' use of electronic health information exchange methods may be Electronic Health influenced by a variety of factors, including state-specific factors such as state laws or the prevalence of a particular exchange method. Our review Information Exchange of the AHA Annual Survey Information Technology Supplement survey Methods May Be data for the eight selected states found that, as of 2021, hospitals' use of Influenced by State- non-electronic and electronic health information exchange methods Specific Factors varied. For example, in Maryland, a state law requires all hospitals, with some exceptions, to use the state's single HIE organization. 37 Among the eight states, Maryland hospitals "often" used HIE organizations to exchange information at the highest rate. According to Washington state agency officials, the state did not use any of its HITECH 90-10 funding to pay HIE organizations, and among the eight states, the percentage of hospitals that reported "often" using HIE organizations to exchange information was lowest in Washington. In Colorado and Minnesota, we found that most hospitals used the same EHR developer. When compared with the other six selected states, a higher percentage of hospitals in Minnesota and Colorado reported "often" exchanging information using EHR vendor-based networks. New Hampshire had among the lowest utilization of HIE organizations and national networks and was the only selected state that did not access HITECH 90-10 funding (see fig. 3). 38 37Md. Code Ann., Health - General, § 19-145 (2022). 38We analyzed AHA Annual Survey Information Technology Supplement survey data and found that, as of 2021, a majority of hospitals in Colorado and Minnesota used the same EHR product from the same EHR developer. While this product was the leading EHR product in the other six selected states, it was not used by a majority of hospitals in any of those states. Page 20 GAO-23-105540 Electronic Health Information Exchange Figure 3: Exchange Methods Often Used by Hospitals in Selected States, 2021 Note: Numbers shown under each state indicate the total number of hospitals in each state that responded to the American Hospital Association Annual Health Information Technology Supplement, 2020. Of the 6,165 acute care hospitals in the U.S. that were surveyed, 2,871 responded to the American Hospital Association Annual Survey Information Technology Supplement. According to Page 21 GAO-23-105540 Electronic Health Information Exchange ONC officials, due to pandemic-related delays, the 2020 AHA Survey Information Technology Supplement survey (which is a supplement to the 2020 AHA Survey) was not fielded on time. It was fielded from April 2021 through September 2021 and instructed respondents to answer questions as of the day the survey was completed. Therefore, these data represent hospitals' experiences in 2021 rather than 2020. Respondents were asked to answer the survey questions as of the day the survey was completed, which included their experiences from 2020. Responses were based on the frequency with which a hospital used the various exchange methods, and these were: often (as shown in the figure), sometimes, rarely, never, and do not know/NA. Findings from this survey may not be generalizable to all hospitals (e.g., hospitals with limited information technology infrastructure), but they illustrate experiences from a variety of hospitals. Electronic Health Stakeholders we interviewed described how electronic health information Information Exchange exchange has been used to support research, payer activities, and public health efforts. In addition, electronic health information exchange Facilitates Research and facilitated states' response to the COVID-19 pandemic. Public Health Efforts • Research efforts. Representatives of four HIE organizations we interviewed said their organizations collect data for or connect to clinical data registries, including cancer, Alzheimer's, and stroke registries. 39 The information is made available to paying subscribers, including those conducting research on these diseases. A representative of another HIE organization explained that their organization analyzes the data to support research studies for several federal agencies and institutions. • Payer activities. Representatives from five of the 10 HIE organizations we interviewed noted that payers use or would eventually be able to use their electronic health information exchange services. Payers that participate in HIE organizations pay subscription fees to obtain the organizations' services. According to an association that represents payers, payers are interested in connecting to HIE organizations and using patients' health data to support their administrative activities, such as processing prior authorizations. 40 • Public health efforts. Representatives from seven HIE organizations we interviewed noted that electronic health information exchange through their organizations supports various public health efforts, such as exchanging data with state immunization registries, supporting 39Clinical data registries are entities that collect and analyze detailed information on the therapies that patients receive and changes in their clinical condition over time in order to evaluate and improve care practices and outcomes. See GAO, Clinical Data Registries: HHS Could Improve Medicare Quality and Efficiency through Key Requirements and Oversight, GAO-14-75 (Washington, D.C.: Dec. 16, 2013). 40A physician and an organization representing physicians expressed concern about payers having access to such data. Page 22 GAO-23-105540 Electronic Health Information Exchange prescription drug monitoring programs, and facilitating disease reporting to public health entities 41 Public health agencies and providers may pay subscription fees to connect to these HIE organizations and can use the information to monitor public health emergencies. • States' response to the COVID-19 pandemic. According to state officials, six of the seven states we reviewed that received HITECH 90-10 funding for electronic health information exchange used HIE organizations specifically to respond to the COVID-19 pandemic. For example, representatives from one HIE organization described how they developed data exchange feeds with laboratories to facilitate contact tracing and referrals for testing services at the beginning of the pandemic. In addition, representatives from seven HIE organizations we interviewed described how their organizations provided assistance to state agencies during the COVID-19 pandemic, such as by using data to help state agencies develop dashboards for public reporting or aggregate data to monitor hospitalization rates throughout the state. Representatives from state agencies and HIE organizations also told us that public health agencies were able to more easily access COVID-19 testing and vaccination data through HIE organizations that facilitated exchange between laboratory facilities, providers, and public health agencies. 42 Similarly, CDC officials stated that they are collaborating with several state and regional HIE organizations on electronic reporting of COVID-19 cases, and HIE organizations have helped communicate with providers about the importance of electronic case reporting and 41Prescription drug monitoring programs are state-run electronic databases that allow health care providers, such as physicians and pharmacists, to review information on prescriptions for opioids and other controlled substances that their patients have previously received. See GAO, Prescription Drug Monitoring Programs: Views on Usefulness and Challenges of Programs, GAO-21-22 (Washington, D.C.: Oct. 1, 2020). 42Studies we reviewed described how the COVID-19 pandemic had demonstrated the importance of HIE organizations and electronic health information exchange generally, such as for forecasting health care facility needs, developing data dashboards, helping hospitals improve care for patients with COVID-19, and tracking immunization data. S. Madhavan et al, "Use of Electronic Health Records to Support a Public Health Response to the COVID-19 Pandemic in the United States: A Perspective from 15 Academic Medical Centers," Journal of the American Medical Informatics Association, vol. 28, no. 2 (Nov. 2020): 393-401; V. O'Reilly-Shah et al, "The COVID-19 Pandemic Highlights Shortcomings in US Health Care Informatics Infrastructure: A Call to Action." The Open Mind (missing publisher and date), DOI: 10.1213 (2020); J. Ye, "The Role of Health Technology and Informatics in a Global Public Health Emergency: Practices and Implications from the COVID-19 Pandemic." JMIR Medical Informatics, vol. 8, no. 7 (Jul. 2020): e19866, DOI:10.2196/19866; M. Caruso, "Effective Data Exchange Leads to Effective Care." Modern Healthcare, vol. 51, no. 25 (Sept. 2021): 57. Page 23 GAO-23-105540 Electronic Health Information Exchange served as a means for connecting providers to CDC when in need of assistance with such efforts. HHS efforts such as TEFCA may address some long-standing HHS Efforts such as impediments to electronic health information exchange. In addition, while TEFCA May Address federal efforts have sought to address privacy concerns, the variation in state privacy laws continues to present challenges to electronic Some Persistent exchange. Impediments to Electronic Health Information Exchange Federal Efforts May ONC officials described how TEFCA has the potential to address some of Address Some Technical the technical challenges that affect electronic health information exchange, specifically the inconsistent implementation of standards and Impediments patient matching. ONC officials stated that TEFCA's standards-based Principle 1 of the Trusted Exchange approach to electronic exchange, which includes requiring Qualified Framework – Standardization Health Information Networks and their participants to adhere to certain standards for exchanging health information, should promote more consistent implementation of standards and improve exchange and the interoperability of information exchanged (see sidebar on Principle 1, Standardization). ONC officials also stated that TEFCA could improve patient matching, as it will standardize the patient demographic information exchanged and used to match patients to their health records (see sidebar on Principle 4, Patient Matching). 43 While some stakeholders acknowledged that The Trusted Exchange Framework and standardization principles in TEFCA hold potential for improving Common Agreement requires that participants use federally adopted health information electronic exchange in the long run, including for patient matching, others technology standards and implement those expressed concern that initially, as a larger volume of patients' health standards in accordance with direction from standard development organizations in order information is shared and accessed, the opportunities for patient to minimize variation in how they are used. matching errors could increase. However, ONC officials noted that Source: GAO analysis of information from the U.S. Department of Health and Human Services, Office of the requirements within the TEFCA technical framework would help to reduce National Coordinator for Health Information Technology the potential risks associated with an increase in data exchange, which (information); GAO (image). | GAO-23-105540 they said is one of the advantages of using TEFCA to expand health information exchange capabilities as compared with expansion under the current paradigm without TEFCA. 43We reported in 2019 that stakeholders described how TEFCA could potentially improve patient record matching if, for example, it resulted in new guidance or standards about demographic data elements. See GAO-19-197. Page 24 GAO-23-105540 Electronic Health Information Exchange Principle 4 of the Trusted Exchange Two stakeholders stated that patient matching has improved in recent Framework – Patient Matching years due to improvements in technology and efforts undertaken by HIE organizations to implement technology to address this issue. However, other stakeholders, including HIE organizations, state agencies, and provider associations, described how it continues to be a challenge. For example, some noted that the lack of a national patient identifier or technology to manage patient identification hinders the ability of providers to consistently identify the correct information for each patient. 44 Recent studies also continued to cite patient matching as a barrier. 45 In addition, HIE organizations and other stakeholders expressed concerns that TEFCA could potentially interrupt HIE organizations' business models as To support accurate patient matching, such as a result of providers opting to connect only to Qualified Health Information when exchanging patients' health information between electronic health record (EHR) Networks and stop paying to connect to state or local HIE organizations. systems, the Trusted Exchange Framework This transition could also potentially negatively affect providers that rely and Common Agreement (TEFCA) requires that Qualified Health information Networks on HIE organizations' services, such as for facilitating patient matching. agree upon and consistently share a core set However, ONC officials told us they thought HIE organizations would of demographic data each time health benefit from TEFCA's technical infrastructure. information is exchanged. In addition, other TEFCA participants are expected to ensure that this core set of demographic data are Stakeholders we interviewed, including representatives from state consistently captured in order to help facilitate the accurate matching of patient records agencies and HIE organizations, also noted that broadband access and based on that demographic information. availability in rural communities had improved in recent years, primarily Source: GAO analysis of information from the U.S. Department of Health and Human Services, Office of the due to federal and state efforts aimed at expanding broadband. However, National Coordinator for Health Information Technology (information); GAO (image). | GAO-23-105540 they noted that despite these efforts, lack of broadband access, particularly in very rural areas of the country, continues to be an impediment to electronic exchange. 44In previous work, we described how stakeholders noted that implementing a national, unique patient identifier specifically for use in health care settings could improve the ability to match patients' medical records. For example, having a new, unique number assigned to an individual would reduce the reliance on demographic data for record matching. See GAO-19-197. HHS stated that, since fiscal year 1999, Congress has prohibited the implementation of a national patient identifier. The restriction, first enacted under the Omnibus Consolidated and Emergency Supplemental Appropriations Act of 1999, prohibits HHS from using any funds to promulgate or adopt any final standard providing for, or providing for the assignment of, a unique health identifier for an individual until legislation is enacted specifically approving the standard. See Consolidated Appropriations Act, 2023, Pub. L. No. 117-328, § 510, 136 Stat. 4459, 4909 (2022). 45Our review of the AHA Survey Information Technology Supplement survey data found that, as of 2021, 48 percent of hospitals responded that patient matching was a barrier to electronically receiving patient information (out of 2,871 respondents). See also J. Adler- Milstein et al., "A Survey of Health Information Exchange Organizations in Advance of a Nationwide Connectivity Framework." Health Affairs, vol. 40, no. 5 (May 2021): 736-744; D. Pai, B. Rajan, and S. Chakraborty, "Do EHR and HIE Deliver on Their Promise? Analysis of Pennsylvania Acute Care Hospitals," International Journal of Production Economics, vol. 245 (Dec. 24, 2021). Page 25 GAO-23-105540 Electronic Health Information Exchange Federal Efforts May Help Stakeholders described how two separate federal efforts have helped or Mitigate Costs, but have the potential to help address financial challenges to electronic health information exchange. First, state agency officials, representatives from Financial Challenges HIE organizations, and other stakeholders noted that the funding made Persist, Particularly for available through the HITECH Act, including EHR incentive payments and Small and Rural Providers 90-10 funding for health information exchange efforts, helped mitigate or support some of the costs related to electronic exchange and helped providers acquire EHR systems they can use for electronic exchange. However, some stakeholders noted that health care providers that were not eligible to receive incentive payments, including behavioral health providers and long-term care facilities, or did not otherwise participate in the EHR Incentive Programs often still lacked EHR systems or EHR systems capable of electronic exchange. Second, ONC officials described how TEFCA could potentially address some of the financial challenges that providers face. For example, officials noted that TEFCA would reduce the number of connections needed to exchange health information between providers and other network participants. As a result, once implemented, participating providers would have a reduced need to develop costly interfaces or connections to exchange information with multiple other health care providers. ONC officials and stakeholders also noted that this could be particularly helpful for small providers or those that serve rural areas of the country, as it would make exchange less costly and give providers potentially more options. However, some stakeholders representing health IT professionals and payers noted that because participation in TEFCA is voluntary, this benefit would depend on the extent of participation. Stakeholders we interviewed also noted that it is not yet clear how TEFCA will be financially sustained and what fees providers and other network participants will need to pay to participate in TEFCA. Stakeholders also described how, at the time of our interviews, costs related to electronic health information exchange continued to be a challenge, particularly for small and rural providers. For example, they described how the costs for updating EHR systems or developing interfaces was a significant challenge to providers' ability to electronically exchange health information, because they often lacked financial Page 26 GAO-23-105540 Electronic Health Information Exchange resources to afford more advanced EHR systems or pay for additional features to be added to their system. One physician we spoke with who runs a private practice told us that the EHR system the practice purchased about a decade ago was outdated, and the practice cannot afford to invest in a new, more advanced system capable of exchange. As a result, the practice uses its system for management of its own health information, but is not able to use it to electronically send or receive health information to others. Additionally, stakeholders we interviewed also described how the cost and availability of health IT staff was a barrier to electronic exchange. A wide range of stakeholders we interviewed, including representatives from HIE organizations and state agencies and providers described how they often struggle to afford or find staff with health IT knowledge to support an infrastructure that is capable of electronic exchange, particularly in rural areas of the country. In a 2019 CDC survey of office- based physicians, 43 percent responded that the lack of health IT staff was a barrier in their ability to electronically exchange health information. Studies we reviewed noted that rural clinics in particular were often understaffed or lacked staff with the necessary health IT expertise to facilitate electronic health information exchange. 46 Federal Efforts May Help Two federal efforts could address some challenges to electronic health Protect Privacy, but information exchange related to privacy laws. First, ONC officials noted that TEFCA uses HIPAA, or terms that are substantially similar to HIPAA, Variation in State Privacy as the privacy baseline that all network participants must adhere to, Laws Remains a including participants not otherwise legally covered under HIPAA (see Challenge sidebar on Principle 4, HIPAA). They noted that the use of this privacy baseline could potentially improve the privacy of the health data exchanged. 47 Officials also described how TEFCA introduced additional requirements of Individual Access Service Providers to protect privacy and security, including the requirement for data to be encrypted and the right to delete data upon request. Representatives we interviewed from a 46B.Sutherland et al., "Expect Delays: Poor Connections between Rural and Urban Health Systems Challenge Multidisciplinary Care for Rural Americans with Diabetic Foot Ulcers," Journal of Foot and Ankle Research, vol. 13, no. 32 (2020); L. Peters, "How HIEs Can Help Improve Care in Rural Communities," Journal of AHIMA (Sept. 13, 2021). 47ONC explained that this includes third-party applications that access patient health information that is exchanged on TEFCA's network. ONC stated that this could improve security of data exchanged by third-party applications that access patient health information exchanged on TEFCA's network, as third-party developers may not generally be covered under the HIPAA Privacy and Security Rules. Page 27 GAO-23-105540 Electronic Health Information Exchange provider association expressed concern that TEFCA will broaden the Principle 4 of the Trusted Exchange Framework – HIPAA scope of the entities that can access patient data. In addition, a number of stakeholders we interviewed noted that misunderstandings of HIPAA continue to pose challenges to electronic health information exchange as providers may incorrectly believe the law prohibits them from sharing certain information. 48 Second, in November 2022, HHS released a proposed rule for comment that intends to better align HHS regulations protecting the confidentiality of substance use disorder patients, known as 42 CFR Part 2 or Part 2, with HIPAA. 49 Under current regulations, different requirements apply to While most health care providers and other the disclosure of substance use disorder treatment records protected by health care entities must follow the Health Insurance Portability and Accountability Act of Part 2 than HIPAA applies to protected health information. According to 1996 (HIPAA) Rules to safeguard information, HHS, the proposed rule, developed in response to a provision in the the Trusted Exchange Framework and CARES Act that requires HHS to bring Part 2 into greater alignment with Common Agreement (TEFCA) recognizes that digital health information is increasingly HIPAA, aims to address challenges providers encounter when collected, shared, or used by new types of exchanging data covered under Part 2 and improve coordination. 50 A organizations that are not covered by the HIPAA Rules. To protect the privacy and number of stakeholders we interviewed described how the current Part 2 security of health information, TEFCA requires regulations create a challenge to health information exchange, as that all TEFCA participants adhere to rules that are substantially similar to HIPAA, information about a patient's substance use disorder diagnosis or including those participants that are not treatment cannot always be easily segmented from other health HIPAA-covered entities. However, this does information being exchanged. Some stakeholders noted that this made it not mean that those non-covered entities are not subject to all the requirements of HIPAA. particularly difficult for behavioral health providers to engage in electronic Source: GAO analysis of information from the U.S. health information exchange. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology (information); GAO (image). | GAO-23-105540 Stakeholders also described how variations in state privacy laws continued to be a hindrance when electronically exchanging health information. For example, stakeholders, including HIE organizations and provider associations, noted that the variations in state privacy laws made it difficult to exchange health information across state lines or work with HIE organizations in other states. States may vary in terms of what information can be exchanged, and it can be hard to comply with multiple sets of laws or laws that do not align with one another. Studies we 48In a 2020 AHA survey of hospitals, 49 percent cited privacy laws, such as HIPAA, as a barrier to electronically receiving health information. 49See 87 Fed. Reg. 74,216 (Dec. 2, 2022). 42 C.F.R. Part 2 prohibits federally-assisted substance use disorder treatment programs from disclosing patient records that would identify a patient as having or having had substance use disorder without the patient's consent. 50See CARES Act, Pub. L. No. 116-136, div. A, § 3221,134 Stat. 281, 375-76 (2020). Page 28 GAO-23-105540 Electronic Health Information Exchange reviewed identified how variations in state privacy laws, specifically the effect of state laws on information exchange and management of patient consent, can be a barrier to health information exchange. 51 We provided a copy of the draft report to HHS for review and comment. Agency Comments HHS provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or GordonLV@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this report. Major contributors to this report are listed in appendix II. Leslie V. Gordon Director, Health Care 51Lenert and McSwain, "Balancing Health Privacy," Apathy and Holmgren, "Opt-in Consent Policies." Page 29 GAO-23-105540 Electronic Health Information Exchange Appendix I: States' Use of HITECH Act Appendix I: States' Use of HITECH Act 90-10 Funding for Health Information 90-10 Funding for Health Information Exchange Activities Exchange Activities Table 2 shows the activities that states receiving Health Information Technology for Economic and Clinical Health Act (HITECH Act) funding for health information exchange efforts had planned. 1 In total, 51 states requested and received HITECH 90-10 funding for health information exchange activities. 2 The information presented in table 2 is based on information aggregated by the Centers for Medicare & Medicaid Services (CMS) in its review of states' written plans. However, states' actual activities may have varied from their submitted plans. To the extent possible, we corroborated the information from CMS with written plans we reviewed from seven selected states and interviews with agency officials in those states. Table 2: Number of States Receiving Health Information Technology for Economic and Clinical Health Act (HITECH Act) Health Information Exchange Funding that Reported Plans for Specific Activities Number of states that reported plans to use HITECH health information exchange-related General activity Specific activity funding for that activity Onboarding providers General onboarding 42 Communications 15 Outreach and marketing 33 Training and education 28 Eligible hospital onboarding 23 Eligible professional onboarding 22 Other clinical provider onboarding 23 Other nonclinical provider onboarding 12 Public health Nonspecific public health activities 32 Immunization registry 36 Cancer registry 17 Syndromic surveillance 22 Specialized registry 29 Electronic lab reporting 28 Prescription drug monitoring program 31 Health information exchange General infrastructure 47 infrastructure Service access layer 14 Secure messaging 20 1We use the term "states" to refer to the 50 states, District of Columbia, and five U.S. territories. 2Illinois, New Hampshire, South Carolina, American Samoa, and Northern Mariana Islands did not access HITECH 90-10 funding for health information exchange activities. Page 30 GAO-23-105540 Electronic Health Information Exchange Appendix I: States' Use of HITECH Act 90-10 Funding for Health Information Exchange Activities Number of states that reported plans to use HITECH health information exchange-related General activity Specific activity funding for that activity Health information exchange Master provider index 17 infrastructure Master patient index 27 Single sign on 15 Community record 14 Nationwide Health Information Network or 20 other gateway Health information exchange General service-related activities 40 services Reporting 34 Electronic clinical quality measure collection 20 efforts Direct messaging 23 Electronic prescribing 4 Query based exchange 29 Event notification 37 Planning General planning 40 Vendor contracting 44 Source: GAO review of Centers for Medicare & Medicaid Services documents. | GAO-23-105540 Note: The term "states" refers to the 50 states, District of Columbia, and five U.S. territories. Page 31 GAO-23-105540 Electronic Health Information Exchange Appendix II: GAO Contact and Staff Appendix II: GAO Contact and Staff Acknowledgments Acknowledgments Leslie V. Gordon, (202) 512-7114 or GordonLV@gao.gov. GAO Contact In addition to the contact named above, Gerardine Brennan (Assistant Staff Director), Andrea E. Richardson (Analyst-in-Charge), Ying Hu, Cynthia Acknowledgments Khan, Christina C. Murphy, Vincent Patierno, Monica Perez-Nelson, Chase Polak, and Roxanna T. Sun made key contributions to this report. Diona Martyn and Eric Peterson also made contributions to this report. Page 32 GAO-23-105540 Electronic Health Information Exchange Related GAO Products Related GAO Products Public Health Emergencies: Data Management Challenges Impact National Response. GAO-22-106175. Washington, D.C.: September 2022. Electronic Health Records: VA Needs to Address Data Management Challenges for New System. GAO-22-103718. Washington, D.C.: February 1, 2022. Prescription Drug Monitoring Programs: Views on Usefulness and Challenges of Programs. GAO-21-22. Washington, D.C.: October 1, 2020. Health Information Technology: Approaches and Challenges to Electronically Matching Patients' Records across Providers. GAO-19-197. Washington, D.C.: January 15, 2019. Health Information Technology: HHS Should Assess the Effectiveness of Its Efforts to Enhance Patient Access to and Use of Electronic Health Information. GAO-17-305. Washington, D.C.: March 14, 2017. Electronic Health Records: Nonfederal Efforts to Help Achieve Health Information Interoperability. GAO-15-817. Washington, D.C.: September 16, 2015. Page 33 GAO-23-105540 Electronic Health Information Exchange The Government Accountability Office, the audit, evaluation, and investigative GAO's Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly GAO Reports and released reports, testimony, and correspondence. You can also subscribe to GAO's email updates to receive notification of newly posted products. Testimony Order by Phone The price of each GAO publication reflects GAO's actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO's website, https://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts. Visit GAO on the web at https://www.gao.gov. Contact FraudNet: To Report Fraud, Website: https://www.gao.gov/about/what-gao-does/fraudnet Waste, and Abuse in Automated answering system: (800) 424-5454 or (202) 512-7700 Federal Programs A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S. Congressional Government Accountability Office, 441 G Street NW, Room 7125, Washington, Relations DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.