Skip Navigation
  • Text Size: A A A
  • Print
  • Email
  • Facebook
  • Tweet
  • Share
  • Print
  • Email
  • Facebook
  • Tweet
  • Share


Statement by
Farzad Mostashari, MD, ScM
National Coordinator
Office of the National Coordinator for Health Information Technology
U.S. Department of Health and Human Services (HHS)

Health IT 

Committee on Finance
U.S. Senate

Wednesday July 17, 2013

Chairman Baucus, Ranking Member Hatch, and distinguished Committee members, thank you for the opportunity to appear today on behalf of the Department of Health and Human Services (HHS).  My name is Dr. Farzad Mostashari and I am the National Coordinator for Health Information Technology.

Building on a decade’s worth of bipartisan legislative work, in 2009, the Congress and President Obama enacted the Health Information Technology for Economic and Clinical Health Act (HITECH) as part of the American Reinvestment and Recovery Act of 2009 (ARRA).  HITECH established the Office of the National Coordinator for Health Information Technology (ONC) in statute and provided the resources and infrastructure needed to stimulate the rapid, nationwide adoption and use of health IT, especially electronic health records (EHRs).

I am pleased to be here today to discuss how health IT benefits patients and provides the tools necessary to transform the delivery of care.  Already, America’s health care providers have made significant progress expanding health information technology use.  Through incentives and other approaches supported by HITECH, we have seen clear evidence that the healthcare community is increasingly using health IT to improve care and change the way it is delivered.

Health IT is Transforming Care

Technology is just a tool - but it is a critical tool that can foster much-needed innovation in entrenched industries.  The nation’s healthcare system is poised for a transformation in how care is delivered and is paid for and how patients engage in their own health and health care. Health information technology supports these transformations.

In the past, our healthcare delivery system based its payments solely on the number of services provided and not on the quality of care delivered to patients.  As a result, patients might receive duplicative tests or services that might not improve their health – and may cost them more in copayments or coinsurance.  As required by the Affordable Care Act, HHS has launched several initiatives to link payments more closely with quality outcomes and promote value-based care.[1]  These reforms promote value over volume and ensure that care is better coordinated across the healthcare delivery system.

As both public and private payers take concrete steps to change the incentives for paying providers, health IT provides the infrastructure for improved care coordination, better quality, and lower costs, as well as the data analytics that providers need to account for the quality and cost of care for populations they serve.

MovingCloser to Patient-Centered Care

Our goal is to assist clinicians and hospitals in using technology to deliver health care in a more meaningful way that is higher-quality, safer, patient-centered, and coordinated.  We want providers to thrive in the new health care marketplace that puts a premium on value over volume, on coordination over fragmentation, and on patient-centeredness overall.

The Centers for Medicare & Medicaid Services (CMS) Medicare and Medicaid EHR Incentive Programs, the ONC-led certification program for health IT, as well as the hands-on technical assistance provided by the Regional Extension Centers (RECs) across the country, are critical in facilitating unprecedented progress in EHR development, adoption and use.  There are nearly 1,900 unique certified products produced by nearly 1,000 developers, and certified by one of five ONC-Authorized Certification Bodies.  ONC’s RECs have signed up more than 145,000 primary care providers (including over 20,000 Nurse Practitioners) in over 30,000 different practices.  This means that over 40 percent of the nation’s primary care providers have committed to meaningfully using EHRs by partnering with their local REC.

To participate in the CMS Medicare and Medicaid EHR Incentive Programs, eligible professionals and hospitals are required to certify that they have used the capabilities of certified EHR technology to meet defined Meaningful Use objectives. At HHS, we believe these meaningful use objectives are strongly aligned with other policy drivers to help our health care system to become safer and more efficient, and achieve higher quality.

Adoption of EHRs has accelerated rapidly in the years since passage of HITECH.  As of May of this year, more than 293,000 eligible professionals and over 3,900 eligible hospitals have received incentive payments from the Medicare and Medicaid EHR Incentive Programs. That represents nearly 80 percent of eligible hospitals and over half of physicians and other eligible professionals.  As of May 2013, more than 220,000 of the nation’s eligible professionals and over 3,000 of the nation’s eligible hospitals have achieved the requirements for Stage 1 Meaningful Use. Tens of thousands more have qualified for Medicaid incentive payments for adopting, implementing, or upgrading to certified EHRs.

While overall adoption of EHRs more than doubled in office practices and more than quadrupled in hospitals between 2008 and 2012, the capabilities of adopted systems have also improved dramatically.  Analyses of nationally representative surveys of office-based physicians and non-federal acute care hospitals show that there has been strong and steady growth in both physician and hospital adoption of EHR technology to meet Meaningful Use objectives to improve quality, safety, and efficiency (Figures 1 and 2).[2][3] For example, computerized provider order entry (CPOE) for medication orders, which is a Meaningful Use requirement, has been shown to cut out nearly half of medication errors.[4] Since HITECH was enacted, the percentage of physicians with CPOE has increased from 45 percent to 80 percent from 2009 to 2012 (Figure 1).  For non-federal acute care hospitals, the percentage with CPOE more than doubled between 2008 and 2012, rising from 27 percent to 72 percent (Figure 2).  Since HITECH, adoption of computerized capabilities related to Meaningful Use objectives generally has grown faster than adoption of those capabilities, which are not required for Stage 1 Meaningful Use (Figure 3).

From 2011 to 2012, growth in physician use of EHR technology to empower patients and families in managing their own health care was especially strong; the share of physicians with computerized capability to provide patients with clinical summaries after each visit increased by 46 percent. Physician adoption of eight other computerized capabilities to improve quality, safety, and efficiency also grew substantially, with increases ranging from 21 percent to 42 percent. [5]

Figure 1. Percent of physicians with computerized capabilities to meet Meaningful Use core objectives: 2009-2012

Figure 1

2012 is significantly different from 2009 for all computerized capabilities (p < 0.01).

SOURCE: ONC analysis of National Center for Health Statistics’ 2009-2012 National Electronic Health Records Surveys.

Figure 2. Percent of non-federal acute care hospitals with computerized capabilities to meet selected EHR Incentive Programs’ Meaningful Use objectives: 2008-2012

Figure 2

All differences are statistically significant from the previous year (p < 0.05).

SOURCE: ONC/AHA, AHA Annual Survey Information Technology Supplement

Figure 3. Percent of physicians with selected computerized capabilities : 2010-2012

Figure 3

2012 is significantly different from 2010 for all computerized capabilities (p < 0.01).

Source: Health Affairs, July 9 web exclusive, insert exact cite when released.

However, much work remains to achieve the promise of Meaningful Use in paving the way for a higher quality, more efficient and safer health care delivery system. While increasing rapidly, adoption still lags behind in small practices and critical access hospitals. The usability of many of the legacy software products are sub-optimal and the cause of frustration for many clinicians on the front lines. While the digitization of healthcare is well underway, the complementary and necessary optimization and redesign of practice workflows is still in its infancy, and perhaps most importantly, there is much work yet to be done to achieve higher levels of interoperability between healthcare providers who use EHR products from different developers.

Stage 2 and a Focus on Interoperability and Exchange

When HITECH was enacted, we understood our mission to be two-fold as the nation moved toward improved health and healthcare through the use of information technology.  First, we need to achieve the adoption of certified health IT. Since the law’s enactment, we have made good progress towards achieving this goal.  We know from the hospitals and clinicians that have achieved meaningful use that it is hard work and the payment represents an important milestone of achievement.

Second, we want to ensure that the systems that have been put in place are interoperable. As several Senators on this Committee have pointed out, improving care coordination through secure and private health information exchange among hundreds of thousands of providers using disparate systems already in place, while accommodating changes in technology, is a daunting task.  Nevertheless, I believe that through the exercise of multiple policy levers, and substantial public-private collaboration, we are making steady progress on this path as well.

The escalating stages of the Medicare and Medicaid EHR Incentive Programs and EHR certification criteria and standards are a critical component of our interoperability strategy.  Stage 1 supported the systematic conversion of key medical information into structured digital format, while we forged consensus on initial national standards for secure communication between systems. We are working with industry to ensure that EHR technology will be significantly more interoperable when Stage 2 begins in 2014.  Guided by two Federal Advisory Committees, we have viewed the EHR Incentive Programs as an escalator that moves progressively upward toward greater interoperability and improved outcomes.  Before we discuss that progress, however, I think it is important that we have a common definition of “interoperability” because the term often means different things to different people.  At ONC, we refer to a definition used by the Institute for Electrical and Electronics Engineering (IEEE) which defines interoperability as “the ability of two or more systems or components to exchange information and to use the information that has been exchanged. [6] That means that there are two parts to the definition of interoperability:  1) the ability of two or more systems to exchange information; and 2) the ability of those two systems to use the information that has been exchanged.

Health information exchange (HIE) is a general term used to convey a variety of ways in which information is electronically shared across all providers of health care to support care delivery. HIE encompasses a broad array of strategies, technologies, types of exchange and applications to facilitate better communication, enabling more coordinated and connected care across the full continuum of provider types and settings. Effective communication and information sharing is essential to improving health, health care delivery, and lowering costs.

It will take time to build to a fully interoperable system of coordinated care and communication across health providers. HHS is working hard to seek out opportunities to accelerate and promote the development of this capacity across the health care system by providing incentives and by reducing barriers to interoperability. HHS is fully committed to ensuring ubiquitous, standards-based, secure exchange of health information across care settings, through consistent, incremental, iterative steps.

When the new requirements related to Stage 2 of the Medicare and Medicaid EHR Incentive Programs begins in 2014, EHR technology will be significantly more interoperable.  To achieve meaningful use in Stage 2, providers will have to exchange, and EHR developers will have to enable the exchange of, a patient care summary with other providers in structured way, (in other words, in a way that can be used) including those with different EHR products.  ONC issued its 2014 Edition Standards and Certification Criteria final rule on September 4, 2012,[7]  which defines the common content, format, and structured data that must be used in order for these systems to be certified. These standards will enable providers to share information as patients make a transition from one care setting to another, which is critically important to support patient care, ensure safety, improve quality, and lower costs.

Meaningful Use Stage 2 places a strong emphasis on electronic health information exchange with other providers.  In Stage 2, both hospitals and eligible professionals will be required to send a summary of the patient’s record electronically to the next provider of care following transitions of care to a new provider or care setting. They will also be required to communicate with patients through secure messaging (like encrypted email) and make patients’ health record information available to them electronically. We believe that these exchange requirements are important steps forward in advancing interoperability.

As envisioned by HITECH, we believe there is an important federal role in recognizing national healthcare standards, and that the certification program authorized by HITECH is a critical tool in achieving interoperability across disparate, competing products. The Medicare and Medicaid EHR Incentive and Certification Programs already require the use of unified standards for recording important clinical information (e.g., problem list, medication list, medication allergy list, race and ethnicity, laboratory test results, etc.) as well as unified standards for the format and transmission of data.  As noted by the Bipartisan Policy Center for Health Information Technology Initiative in its report on interoperability,[8] the initial standards needed for clinicians to support care transitions are, in general, “well supported by Stage 2 requirements.”

There is significant work yet to be done on accelerating consensus on interoperability standards that enable additional healthcare information to be securely exchanged and used across healthcare organizations and software systems. The ONC Standards and Interoperability Framework[9] provides an effective forum for convening industry and experts in identifying unified solutions to high-priority interoperability challenges.

Furthermore, in March, ONC and CMS released a request for information that asked the industry for input to help us accelerate health information exchange across settings of care in order to support care coordination and delivery reform[10].  We recognize that both providers and EHR vendors do not always have a business imperative to share individual -level health information across providers and settings of care. To further accelerate and advance interoperability and health information exchange beyond what is currently being done through ONC programs and the Medicare and Medicaid EHR Incentive Programs, HHS is considering a number of policy levers using existing authorities and programs. The overarching goal is to develop and implement a set of policies that would encourage providers to exchange health information routinely through interoperable systems in support of care coordination across health care settings.

HHS has been leveraging HHS programs and resources to promote interoperability.  For example, ONC’s State HIE Program has worked with each state to plan and implement an approach to promoting information exchange that is tailored to each state’s circumstances and resources.

Indiana, for example, is providing vouchers to hospitals, health centers, labs and radiology centers to help them connect to existing HIE services that blanket the state.  Maryland has developed a more centralized statewide HIE infrastructure focused on activities such as alerting primary care providers when patients are discharged from hospitals and geo-mapping health care utilization across the state to identify areas where quality, safety, and efficiency improvement efforts should be targeted. These grant-funded activities have enabled nearly 20,000 health care-related organizations and over 112,000 clinical and administrative staff to exchange patient’s health information in support of better, safer care.  During the first quarter of 2013, the program’s grantees reported more than 172 million secure messages were sent to support activities such as safe transitions of care and receipt of lab results.  An additional 5 million queries for patient information helped improve care coordination where information had not followed the patient. ONC has also worked closely with CMS to ensure HIE is accelerated through new programs such as the State Innovations Model Initiative, the Health Care Innovation Awards, and Medicaid waivers.

Although ONC and CMS have been diligently working on health information exchange, we know we still have work to do.  Through our work and research, we have identified a number of barriers to health information exchange.  Currently, there is limited sharing of health information during transitions of care among providers.[11] A 2012 Commonwealth survey of primary care physicians in the United States found that less than one in four physicians is notified when their patient visits the emergency room and less than half receive information needed to help manage their patient’s care within 48 hours after discharged from the hospital. Furthermore, only 16 percent receive information from specialists regarding changes made to their patient’s medication or care plan.

Increasing providers’ capability to exchange information electronically with other providers has the potential to help address existing gaps in health information sharing between health care providers. Providers overwhelmingly believe that electronic health information has the potential to improve the quality of patient care and coordinate care.[12]  Expanding interoperability can make it easier and less costly to share health information among providers.

ONC recognizes that increasing electronic exchange of health information among providers will involve a multi-pronged approach. Some key challenges perceived by physicians relate to technical barriers, such as the ability of EHR systems to communicate with other systems, the lack of an exchange infrastructure, and the costs of exchanging health information, such as interface costs and transaction fees.[13] Additionally, there have not been significant business drivers to promote information sharing to date – historic reimbursement structures that pay for more tests and services as opposed to the quality of care delivered to patients have generally encouraged providers to hold onto patient information rather than share it.  A large number of health care organizations have implemented systems that were not built according to national standards.  Furthermore, system-wide change within provider practices can often be time-consuming and disruptive. The steps we have outlined address these problems head-on and should promote health information exchange and interoperability over the coming years.

Promoting Innovation and Care Coordination

HITECH established several programs to promote EHR adoption across the United States for eligible hospitals and professionals and to assist providers with implementation.  As it becomes evident that health IT is a fundamental component to new payment and delivery system models, several of these programs are helping to support providers as they prepare for system changes.

Small practices have historically had challenges optimizing health IT to improve the quality of care they provide to their patients, due to a lack of resources and/or expertise. Per the 2010 National Ambulatory Medical Care Survey (NAMCS), small independently-owned practices with 10 or fewer physicians provide over 85.5 percent of all ambulatory care visits.[14] These providers play an essential role in the national health care delivery network by serving as the home-base for preventive care, information and services patients and families need to stay healthy, and as a linkage to the broader health care system, including hospitals and specialists.  Several of the HITECH programs specifically address disparities in EHR adoption among providers working in underserved areas (including rural areas and those with high numbers of uninsured patients).

RECs Enabling Care Delivery Transformation– The REC Program consists of 62 heterogeneous non-profit organizations and the national Health Information Technology Research Center (HITRC) that provides state-of-the-art technical assistance on best practices for EHR adoption. RECs directly assisted providers in their understanding of the Medicare and Medicaid EHR Incentive Programs, support providers during the EHR

The RECs are successfully reaching out to support primary care providers operating in medically underserved regions nationwide to implement certified EHR technology and demonstrate Meaningful Use. Based upon a recent study, REC enrollment rates were highest in rural areas.[15] Specifically, REC enrollment rates were found to be higher for small rural (non-Core Based Statistical Area, 56 percent) and micropolitan areas (47 percent) compared to urban or metropolitan areas. Critical access hospitals (CAHs) and selection process for their practices; and, train practice staff in workflow redesign, project management, and technology and security assessments.

The REC program has been successfully assisting primary care providers nationwide to adopt EHRs and demonstrate Meaningful Use. A Government Accountability Office (GAO) report found that Medicare providers working with RECs were over 2.3 times more likely to receive an EHR incentive payment then those who were not working with a REC.[16] Almost half (46 percent) of providers who received incentives from the Medicaid EHR Incentive Programs for attesting to Meaningful Use, and one-fifth (21 percent) of providers who received incentives from the Medicare EHR Incentive Programs have participated in the REC program.[17]

The RECs are successfully reaching out to support primary care providers operating in medically underserved regions nationwide to implement certified EHR technology and demonstrate Meaningful Use. Based upon a recent study, REC enrollment rates were highest in rural areas.[18] Specifically, REC enrollment rates were found to be higher for small rural (non Core Based Statistical Area, , 56 percent) and micropolitan areas (47 percent) compared to urban or metropolitan areas. Critical access hospitals (CAHs) and small rural hospitals have also recently shown progress toward achieving Meaningful Use, with strong enrollment in RECs as well.[19]

REC enrollment rates were also found to be highest in counties with the greatest health professional shortages. In particular, for whole-county Healthcare Provider Shortage Areas (HPSAs), which are areas that have provider shortages spanning an entire county, RECs assisted 52 percent of providers. In geographic HPSAs, which have shortages in specific geographic areas within the county but not the entire county, RECs assisted42 percent of providers.

More than 80 percent of all Federally Qualified Health Center (FQHC) grantees are enrolled with a REC. Many FQHCs have specific quality improvement goals such as efforts to promote the use of proven self‐management education programs by individuals with chronic conditions such as heart disease and diabetes.

Because health IT is an integral component to the transformation of the delivery and payment of health care, ONC believes that the RECs are uniquely equipped to support better quality care and lowering costs by helping providers to identify, understand, and implement best practices and quality improvement initiatives using health IT.

Additionally, with the strong uptake of Meaningful Use of EHRs by providers in 2012, RECs are well positioned to continue to assist providers with the full implementation of the EHR Incentive Programs and further develop and implement other core competencies such as privacy and security assessments, health information exchange, and education. Supporting providers’ efforts to use health IT to transform the delivery of care is a natural extension of the RECs' work to get providers to meaningfully use EHRs.

RECs continue to leverage their ability to provide technical assistance and support by working in partnership with other agencies, for example, CMS, on priorities such as the Comprehensive Primary Care (CPC) Initiative and the Medicare Shared Savings Program, which includes participation from Accountable Care Organizations (ACOs). A good example of this support is the New Jersey Health Information Technology Extension Center (NJ-HITEC), New Jersey’s REC. The Barnabas Health Accountable Care Organization in New Jersey partnered with NJ-HITEC to receive support for its ACO. Specifically, NJ-HITEC assisted Barnabas with initial data analytics, which required matching of over 1,000 providers to beneficiaries and then extracting quality data from the EHRs and paper-based charts. The REC then conducted in-office analytical review of both the EHR and paper-based records. Once reviewed and analyzed, the abstracted quality data was entered into Medicare's group quality reporting system, which generated real-time analysis that was necessary for ACO Improvement, reports card delivery and, education to the physician ACO members.

Comprehensive Primary Care Initiative

ONC collaborated with CMS’s Center for Medicare and Medicaid Innovation (Innovation Center) to recruit providers for the Innovation Center’s Comprehensive Primary Care Initiative, reaching out to providers that were both enrolled or not yet enrolled with the REC program. The Innovation Center selected 500 practices and over 2,000 providers into the initiative. The RECs in New Jersey, Arkansas, New York, and Ohio are currently working with the Innovation Center to support providers participating in the initiative in their respective markets.  The ONC and the CMS Innovation Center continue to collaborate on opportunities to enhance technical assistance to providers in the initiative.

Beacon Community Program Lighting The Way -- The Beacon Community Cooperative Agreement Program demonstrates how health IT investments and Meaningful Use of EHRs advance the vision of patient-centered care, while improving quality and helping to improve the efficiency of the health care system. These 17 communities throughout the United States have demonstrated progress in the development of secure, private, and accurate EHR systems and health information exchange infrastructure and are providing important lessons for transforming delivery systems throughout the country. As of the end of 2012, over 8,700 providers were participating in the Beacon Communities, and Beacon investments touched over eight million lives. Each of the 17 communities—with its unique population and regional context—is actively pursuing the following areas of focus:

  • Building and strengthening the health IT infrastructure and exchange capabilities within communities, positioning each community to pursue a new level of sustainable health care quality and efficiency over the coming years;
  • Translating investments in health IT to measureable improvements in cost, quality and population health, and;
  • Developing innovative approaches to performance measurement, technology and care delivery to accelerate evidence generation for new approaches. For example, in the Greater Cincinnati Beacon Collaboration has been testing innovative solutions to improve asthma care using hospital admission, discharge and admission-discharge-transfer alerts (ADT alerts) which are improving transitions of care, and preventing avoidable emergency department and inpatient hospital visits. [20]  

Aligning Quality Measures – As we move into a transformed delivery system, we hear from providers about the need for the federal government to work more closely to align our efforts with both public and private partners.  I want to assure you how seriously we take this concern and how important we believe this effort is to successful delivery system reform.  To this end, ONC has worked closely with CMS in the development of clinical quality measures that enable providers to better understand their performance relative to quality standards.  In addition, ONC has developed a rigorous testing platform as a component of our 2014 EHR technology certification program that requires that every EHR capture the data necessary to compute clinical quality measures, calculate the measures accurately, and report the results of that calculation in a standard way to CMS.

State HIE Program Ensuring Exchange Tools Are Available for All – The State HIE Program has awarded funds to all 56 states and territories to ensure exchange tools are available across the broad health care eco-system.  To date, 49 states have exchange services available that help providers make transitions of care safer and more than 30 states have services available to help providers look-up patients’ health information even if they are not sure where the patient has previously received care.  In addition to supporting providers working to achieve meaningful use, the State HIE Program has worked to ensure ineligible providers are not left behind.  ONC has funded four states (CO, MD, MA, OK) to develop replicable approaches to improve long-term and post acute care (LTPAC) transitions.  The initiatives are piloting approaches that meet LTPAC providers where they are today across the health IT adoption spectrum.

Since 2011, representatives from Florida, Michigan, Kentucky, Alabama, Nebraska, Iowa and New Mexico have participated in the Behavioral Health Data Exchange (BHDE) Consortium to address legal and technical barriers to the exchange of behavioral health data between health care providers, among organizations, and across state lines.

Ensuring that Patient Information Is Safe and Secure

Underlying all our efforts is the core understanding that we will not succeed if patients do not trust that their health information will be kept safe and secure in an increasingly electronic and interoperable world.  We firmly believe that everyone who is involved in the health care sector (including the government, the developers, the health plans, the providers, and the patients) shares the responsibility for protecting patient information.  We address this complex issue from a number of different perspectives.

First, pursuant to HITECH, HHS has used its regulatory authority to expand the protections afforded to individually identifiable health information. The Privacy Rule issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) limits the use and disclosure of identifiable health information held by most health care providers.  Its companion rule, the HIPAA Security Rule, requires health care providers to have administrative, technical, and physical safeguards for electronic identifiable health information.  These protections are intended to ensure that health information remains private, that it is not inappropriately changed or deleted, and that it remains available.

HHS recently has issued regulations under HITECH that expand the categories of organizations and people who are required to protect electronic protected health information under HIPAA to the contractors of HIPAA-covered health care providers and health plans, including health information organizations, e-prescribing gateways, and others that facilitate data transmission, as well as their subcontractors.  The EHR Incentive Programs requires providers to conduct or review a security risk analysis in accordance with the HIPAA Security Rule as part of the meaningful use core objectives.

In addition to HIPAA, a number of federal and state privacy laws restrict the disclosure of sensitive health data including those pertaining to behavioral health, HIV status, genetic tests, reproductive rights, and adolescent treatment, among others. These laws often protect individuals from the most vulnerable segments of our society and who represent a disproportionate share of healthcare costs in this country.  Many of these laws, including 42 CFR Part 2 (for substance abuse), establish detailed requirements for obtaining patient consent for sharing health information. Currently, most EHR and HIE systems do not have the capacity to manage these consents or to control the re-disclosure of select types of information as required which poses a significant barrier to the integration of primary and specialty health care, especially behavioral health care.

In order to address the diversity in privacy regulations, ONC initiated the Data Segmentation for Privacy (DS4P) Initiative to develop and pilot test standards for managing patient consents and data segmentation. An implementation guide for consent management and data segmentation was released in the summer of 2012 and is currently being piloted. HHS is focused on developing solutions to protect patient privacy and enable integrated care without creating data silos that could negatively impact the quality of care for patients with sensitive health conditions.

Furthermore, HHS has taken steps to encourage and require developers of EHRs to build security into their products.  This will make it easier for health care providers to secure their health information in a cost-effective manner.  In particular, ONC has included the following security-related capabilities that EHR technology must have in order to be certified under the 2014 edition standards and certification criteria.  To be certified, EHR technology must be able to:

  • By default, encrypt the electronic health information stored on end user devices such as desktops, laptops, and smart phones;
  • Authenticate users of the EHR technology system;
  • Limit access to the EHR technology system;
  • Record, by default, auditable events such as accessing data; and
  • Produce an audit report.

In addition, HHS has endorsed the Office of the Inspector General’s recommendation that it use its leadership role to provide guidance to the health care industry on security best practices by developing and publishing a number of privacy and security technical assistance materials in a variety of easy-to-use formats including short videos and training games.  Just one example of this work is our on-line resource center for securing mobile devices.  Early on, we recognized the trend toward using mobile devices in health care and within less than one year, developed and posted numerous plain language materials to educate providers on how to secure these devices. We intend to continue to assess the ever evolving health IT market and to address privacy and security vulnerabilities as they develop.

Moreover, HHS will continue to monitor for any unintended consequences across the health system.  The Health IT Patient Safety Action and Surveillance Plan (“Safety Plan” or “Plan”) addresses the role of health IT within HHS’s commitment to patient safety and builds upon the recommendations made in the 2011 Institute of Medicine (IOM) Report Health IT and Patient Safety: Building Safer Systems for Better Care.[21]  The Plan has two related objectives:

  1. Use health IT to make care safer, and
  2. Continuously improve the safety of health IT.

Consistent with the premise that all stakeholders share the responsibility to ensure that health IT is used to make care safer, the Plan leverages existing authorities to strengthen patient safety efforts across government programs and the private sector—including patients, health care providers, technology companies, and health care safety oversight bodies. It also lays out concrete steps to increase knowledge about the impact of health IT on patient safety and maximize the safety of health IT-assisted care.

ONC released the Health IT Safety Plan for public comment on December 21, 2012 and published the final version on July 2, 2013.  ONC is coordinating the Plan's implementation through our Health IT Safety Program.[22]

FDASIA Workgroup on Risk-Based Regulatory Framework for Health IT

Because of its demonstrated success in providing sound advice on health IT initiatives, ONC looked again to the HIT Policy Committee when the Congress, through the  Food and Drug Administration Safety and Innovation Act (FDASIA), required the Food and Drug Administration (FDA) and the Federal Communications Commission (FCC), in collaboration with ONC, to develop a report on an appropriate, risk-based regulatory framework pertaining to health IT, including mobile medical applications, that promotes innovation, protects patient safety, and avoids regulatory duplication.[23]  On April 18, 2013,[24] ONC, FDA, and FCC announced the members of the FDASIA Workgroup – under ONC’s HIT Policy Committee -- that will help that Committee provide expert advice to FDA, ONC, and FCC for the development of the report required by FDASIA.  Consistent with the statute, the workgroup is geographically diverse and includes representatives of patients, consumers, health care providers, startup companies, health plans or other third-party payers, venture capital investors, information technology vendors, small businesses, purchasers, employers, and other stakeholders with relevant expertise.  As with ONC Federal Advisory Committee Workgroups, FDASIA Workgroup meetings are public, and documents discussed at the meetings are publicly available, as appropriate. We greatly appreciate the leadership and interest of Senators Harkin, Hatch, Bennet, and Enzi on these issues and we look forward to continuing to work with the Congress to promote innovation and protect patient safety.

Consumers – The Most Underutilized Resource in Healthcare

Over the past few decades, we have seen information technology improve the consumer experience in almost every aspect of our lives, including the way we manage our finances, shop, and book travel.  But, health care has been slower to leverage this technology.  Most notably, relevant information is not available to patients when and where it is needed.

Technology helps enable the use of consumer knowledge by helping consumers to:

  • Better understand their health and healthcare,  e.g., via tailored educational resources;
  • Coordinate their care by sharing data among providers and other members of their care team;
  • Communicate with providers between visits in real time (e.g., via secure messaging)
  • Use software applications apps and tools to manage their health and healthcare and to meet the health goals they set for themselves; and
  • Improve the quality of data about them (e.g., identify and address errors or omissions in their records).

Increasingly, people are taking their health into their own hands—whether that means tracking their health through a smartphone app or a remote monitor, participating in online patient or caregiver communities, or accessing their medical records online.  Changes in consumer technology, such as the growth of mobile phones, are helping to drive this change -- nearly nine out of ten people own a mobile device and nearly half of all Americans own a smartphone.[25]  Mobile devices offers several advantages over traditional PCs—they can help remove traditional barriers such as geography and time, can break down the digital divide in underserved communities, can enable remote treatment, and can facilitate more continuous health monitoring, which makes health care more convenient and personalized.

The mobile devices in our pocket can help us access a world of information at the right time to help make the right health decisions, which is important since 80 percent of Internet users have gone online seeking health information.[26]  The Department of Defense has developed apps to help veterans and their caregivers cope with post-traumatic stress disorder.  Mobile phones can be an incredible tool for empowering consumers to take control of their health, their care, and their healthcare finances and as we know from the literature, more engaged consumers get better outcomes[27].

ONC’s strategy in consumer eHealth is to work with partners to increase patients’ ability to access their own health data, to increase the use of these data for actionable apps and services, and to shift attitudes around patient empowerment. An increasingly popular symbol for access to personal health data and the greater consumer engagement it supports is the “Blue Button” – a blue circle with a download arrow in the center first used by the Department of Veterans Affairs (VA) on their patient portal to enable veterans to download their health records “at the click of a button.” In 2010, the Department of Defense (DOD) also incorporated Blue Button into their TRICARE Online PHR site. Military retirees and or veterans discharged after 1979 now have secure online access to lab results, patient histories, diagnoses, and provider visits.

Building on Blue Button’s initial popularity, in 2011 responsibility for the Blue Button brand and functionality nationwide was transferred officially to HHS.  To support that effort, ONC has been coordinating closely with the VA and the Presidential Innovation Fellowship Program through which a total of six private sector fellows have been assigned to develop technical guidelines (called Blue Button Plus) for data holders and developers. In addition, we are also encouraging institutions that have health data to make it easier for patients to gain easy, electronic access to their data and to use that information in ways that improve their health and health care.  The Blue Button Pledge Program is a voluntary mechanism for supporting consumers’ access to their health data.  The Blue Button Pledge Program now includes more than 450 organizations that are committed to learning and collaborating in efforts to increase patient access to, and use of, health data.  The Pledge Program, launched in 2011, includes “data holders”—such as health care providers and insurers—who pledge to improve the accessibility of health data to patients and other authorized users, and “non–data holders”—such as software developers and consumer advocacy organizations— who pledge to educate consumers about the value of getting and using their health data. The “data holder” organizations that participate in the Blue Button Pledge Program collectively reach more than 88 million Americans.

The government is leading by example in implementation of Blue Button.  Veterans today can access their medical records online, and download their records with a simple click of a “Blue Button”- and more than one million veterans have done so.  Medicare beneficiaries can access and download three years of their Medicare claims online today – and by using an app like iBlueButton, carry that information on their mobile devices.  HHS is also encouraging Medicare Advantage plans to expand the use of Blue Button to provide beneficiaries with one-click secure access to their health information.  And the Federal Employee Health Benefits program has asked carriers to do the same. 

Meaningful Use Stage 2, as part of the Medicare and Medicaid EHR Incentive Programs, requires eligible providers to use secure e-mail with patients and to provide patients with a way to view, download, and transmit their own health information beginning in 2014 for hospitals and eligible professional such as doctors.  Under Stage 2, patients will be able not only to view their health information online, but also to export their data from EHRs in structured and human-readable formats; share those data with others; and use tools and applications to store, analyze, or otherwise make use of their information.  Stage 2 also establishes thresholds for the proportion of patients using these functions, which will encourage providers to promote their use. Through both Meaningful Use and the Blue Button initiative, HHS is increasing the flow of personal health data to patients and consumers directly, and thus inviting them to engage more fully in their health and health care.  Among the most powerful benefits of such engagement is that consumers themselves will be able to serve as the connection point among numerous members of the care team, functioning as their own “health information exchanges.”  It is not uncommon for an individual to have multiple providers – the average cancer patient has 32 – so the capacity to coordinate care among them is essential.  Many patients also have a significant network of informal caregivers.  Consumers or patients are arguably best positioned to decide whom to bring into their circle of care, and when and with whom to share their vital health information.


We are rapidly moving toward a 21st century healthcare system with smarter, higher quality care that is both patient-centric and less costly. We are changing how we pay for healthcare by focusing on improved care coordination and on new delivery and payment models. Health IT is critical to the success of these new programs; programs such as ACOs, bundled payments, health and medical homes, and the implementation of CMS’s hospital readmissions policies. 

In addition to better coordination of care, through the use of health IT, there will be greater access to patient health information that is integral to improving the quality, efficiency, and safety of health care delivery. Already, across the country, more and more clinicians are using health IT as a tool to provide safer and more secure care.

We have already seen the successes of electronic health records and health IT: clinicians are securely exchanging patients’ records and improving outcomes by ensuring that patients do not have to undergo duplicate or unnecessary procedures; more than two-thirds of office-based doctors check medication orders for harmful drug interactions, over half share clinical summaries with their patients; and, with access to their own information, patients become more engaged in their care and experience better outcomes.[28]

New technologies – including health IT and mobile applications – offer great promise to transform the way health care is delivered.  Our progress in moving towards these goals has been steady and deliberate.  Working within an open and transparent process with our public and private stakeholders, we are on a path toward achieving a truly interoperable health system in which clinicians and patients can talk to each other online – no matter which EHR system they have in place.

To transform delivery, health care providers must also redesign and reengineer the workflow of care.  Though this work is well underway, it does not happen overnight.  Health IT holds tremendous promise for delivering “smart health” to patients right at their fingertips to help all of us achieve the best possible outcome for each individual.  We must carefully balance the need for the widest innovation possible, with protection of patient privacy, security, and safety.

We look forward to continuing to working with the Congress to accomplish these goals.  I would be happy to answer any questions that you may have regarding my testimony.

[1] See Statement of Richard J. Gilfillan, M.D., Director, Center for Medicare and Medicaid Innovation, Centers for Medicare & Medicaid Services on Reform of the Delivery System, Before the Committee on Finance, U.S. Senate, March 20, 2013.
[2] King J, Patel V, Furukawa MF. Physician Adoption of Electronic Health Record Technology to Meet Meaningful Use Objectives: 2009-2012. ONC Data Brief, no. 7. Washington, DC: Office of the National Coordinator for Health Information Technology. December 2012.
[3] Charles D, King J, Furukawa MF, Patel V. “Hospital Adoption of Electronic Health Record Technology to Meet Meaningful Use Objectives: 2008-2012,” ONC Data Brief, no. 10. Washington, DC: Office of the National Coordinator for Health Information Technology. March 2013
[4] Kaushal R, Shojania KG, Bates DW. Effects of computerized physician order entry and clinical decision support systems on medication safety: a systematic review. Arch Intern Med, 2003 Jun 23: 1409-16.
Shamliyan TA, Duval S, Du J, Kane RL. Just what the doctor ordered. Review of the evidence of the impact of computerized physician order entry system on medication errors. Health Serv Res. 2008 Feb;43(1 Pt 1):32-53.
[5] King J, Patel V, Furukawa MF. Physician Adoption of Electronic Health Record Technology to Meet Meaningful Use Objectives: 2009-2012. ONC Data Brief, no. 7. Washington, DC: Office of the National Coordinator for Health Information Technology. December 2012.
[6] See IEEE Standard Computer Dictionary:  A Compilation of IEEE Standard Computer Glossaries (New York, NY:  1990).
[7] This final rule is entitled “Health Information Technology: Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology, 2014 Edition; Revisions to the Permanent Certification Program for Health Information Technology” and is available at:
[8] Accelerating Electronic Information Sharing to Improve Quality and Reduce Costs in Health Care. Bipartisan Policy Center Health Information Technology Initiative, October 2012. disclaimer icon
[11] Commonwealth Fund. Article Chartpack. Schoen C & Osborn R. The Commonwealth Fund  2012 International Health Policy Survey of Primary Care Physicians. International Symposium on Health Care Policy. November 2012. disclaimer icon
[12] Clinician Perspectives on Electronic Health Information Sharing for Transitions of Care Bipartisan Policy Center Health Information Technology Initiative. October, 2012
[13] Clinician Perspectives on Electronic Health Information Sharing for Transitions of Care Bipartisan Policy Center Health Information Technology Initiative. October, 2012
[14] The National Ambulatory Medical Care Survey 2010, Centers for Disease Control and Prevention
[15] Samuel CA, King J, Adetosoye F, Samy L, Furukawa MF. Engaging providers in underserved areas to adopt electronic health records. American Journal of Managed Care. 2013;19(3):229-34
[16] GAO, Electronic Health Records: Number and Characteristics of Providers Awarded Medicare Incentive Payments for 2011, GAO-12-778R (Washington, D.C.: July 26, 2012).
[17] Customer Relationship Management (CRM) Tool, maintained by the Office of Provider Adoption and Support (OPAS) at ONC, March 19, 2013 merged by NPI to data on EPs in the Medicare or Medicaid EHR Incentive Programs as of January 31, 2013.
[18] Samuel CA, King J, Adetosoye F, Samy L, Furukawa MF. Engaging providers in underserved areas to adopt electronic health records. American Journal of Managed Care. 2013;19(3):229-34
[19] Heisey-Grove D, Hufstader M, Hollin I, Samy L, Shanks, K. Progress towards the meaningful use of electronic health records among critical access and small rural hospitals working with Regional Extension Centers. ONC Data Brief, no. 5. Washington, DC: Office of the National Coordinator for Health Information Technology, November 2012.
[20]To date, 27,000 alerts have been shared across 21 hospitals, 87 primary care practices, and 2 post-acute providers. According to Cincinnati Beacon’s 2012 annual report, children admitted to the hospital for asthma are now 50 percent less likely to be readmitted or to be seen in the emergency department within 30 days, and are 23 percent less likely to return within 90 days.
[23] Section 618(a) of FDASIA charges the HHS Secretary (acting through the FDA Commissioner, in consultation with ONC and with the FCC Chairman) to publish a report by January 2014 that contains "a proposed strategy and recommendations on an appropriate, risk-based regulatory framework pertaining to health information technology, including mobile medical applications, that promotes innovation, protects patient safety, and avoids regulatory duplication.”
[24] See for a complete list of workgroup members.
[27] Bipartisan Policy Center: Improving Quality and Reducing Costs in Health Care: Engaging Consumers Using Electronic Tools. disclaimer icon
[28] Aspen Institute: Adopters of Health Information Technology Starts to See Its Benefits. August 2012 disclaimer icon

Last revised: July 22, 2013