ELECTRONIC
HEALTH
INFORMATION
EXCHANGE
Use Has Increased,
but Is Lower for Small
and Rural Providers
Report to Congressional Requesters
April 2023
GAO-23-105540
United States Government Accountability Office
United States Government Accountability Office
Highlights of GAO-23-105540, a report to
congressional requesters
April 2023
ELECTRONIC HEALTH INFORMATION
EXCHANGE
Use
Has Increased, but Is Lower for Small and Rural
Providers
What GAO Found
Electronic health information exchange is the ability to exchange medical records
and other health information electronically among health care providers and
between health care providers and patients. The Health Information Technology
for Economic and Clinical Health (HITECH) Act provided federal enhanced
Medicaid matching funds to states through 2021 to support certain efforts to
advance electronic exchange. Nearly all states used these funds, and most have
identified other sources to sustain those efforts.
Survey data show that the use of various electronic exchange methods among
hospitals and physicians has increased in recent years. However, GAO found
that as of 2021, reported use among small and rural hospitals was lower than
that of other hospitals. For example, see figure illustrating use by size of hospital.
Exchange Methods Often Used among Acute Care Hospitals by Size, 2021
Stakeholders GAO interviewed noted that small and rural providers were less
likely to have the financial and technological resources to participate in or
maintain electronic exchange capabilities.
Federal efforts may address some impediments to electronic health information
exchange. Specifically, the Trusted Exchange Framework and Common
Agreement being implemented by the Office of the National Coordinator for
Health Information Technology (ONC)—which aims to describe a common set of
nonbinding principles to help facilitate exchange among health information
networks—may mitigate costs providers face by providing a simpler approach to
connecting with other providers. However, stakeholders noted that participation
in this effort is voluntary and does not address issues like information technology
staffing shortages and gaps in broadband access that pose particular challenges
to electronic exchange for small and rural providers.
View GAO-23-105540. For more information,
contact
Leslie V. Gordon at (202) 512-7114 or
.
Why GAO Did
This Study
Widespread adoption of electronic
health information exchange has the
potential to improve health care quality
and reduce costs. While
these goals
have
been pursued for years, they
have
proved challenging to realize.
Through the HITECH Act, the federal
gov
ernment provided $2.4 billion to
states to improve and advance certain
aspects of electronic health information
exchange.
In light of this federal investment, GAO
was asked to review health information
exchange.
This report describes (1)
states
’ use of the HITECH funding for
health information exchange efforts
and
their plans to replace those funds,
(2) the extent to which use of electronic
health information exchange has
changed
since the enactment of the
HITECH Act
, and (3) federal efforts
that
aim to address challenges to
electronic health information exchange.
GAO reviewed information and
intervie
wed officials from ONC and the
Centers for Medicare
& Medicaid
Services, the agency that administered
the
HITECH funding. GAO also
conducted interv
iews with state
agencies
in eight states selected
based on geographic variation and
whether states accessed
the HITECH
funding for health information
exchange, among other factors.
In
addition, GAO
analyzed hospital and
physician survey data, and interviewed
a range of
stakeholders, including
physicians and
organizations
representing physicians, as well as
organizations representing hospitals,
payers,
health information exchange
organizations,
and other industry
representatives
.
Page i GAO-23-105540 Electronic Health Information Exchange
Letter 1
Background 6
Nearly All States Used HITECH 90-10 Funding to Support
Electronic Health Information Exchange, and Most Have
Identified Other Funding for the Future 13
Use of Electronic Health Information Exchange Has Increased but
Is Lower for Small and Rural Providers 17
HHS Efforts such as TEFCA May Address Some Persistent
Impediments to Electronic Health Information Exchange 24
Agency Comments 29
Appendix I States’ Use of HITECH Act 90-10 Funding for Health Information
Exchange Activities 30
Appendix II GAO Contact and Staff Acknowledgments 32
Related GAO Products 33
Tables
Table 1: Examples of Selected States’ Use of Health Information
Technology for Economic and Clinical Health (HITECH)
Act 90-10 Funding for Health Information Exchange
Efforts 14
Table 2: Number of States Receiving Health Information
Technology for Economic and Clinical Health Act
(HITECH Act) Health Information Exchange Funding that
Reported Plans for Specific Activities 30
Figures
Figure 1: Electronic Health Information Exchange Scenarios 8
Figure 2: Exchange Methods Often Used among Hospitals, by
Characteristic, 2021 19
Figure 3: Exchange Methods Often Used by Hospitals in Selected
States, 2021 21
Contents
Page ii GAO-23-105540 Electronic Health Information Exchange
Abbreviations
AHA American Hospital Association
CDC Centers for Disease Control and Prevention
CMS Centers for Medicare & Medicaid Services
EHR electronic health record
HHS Department of Health and Human Services
HIE organization health information exchange organization
HIPAA Health Insurance Portability and Accountability
Act of 1996
HITECH Act Health Information Technology for Economic
and Clinical Health Act
ONC Office of the National Coordinator for Health
Information Technology
TEFCA Trusted Exchange Framework and Common
Agreement
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
Page 1 GAO-23-105540 Electronic Health Information Exchange
441 G St. N.W.
Washington, DC 20548
April 21, 2023
The Honorable Brett Guthrie
Chair
The Honorable Anna Eshoo
Ranking Member
Subcommittee on Health
Committee on Energy and Commerce
House of Representatives
The Honorable Michael C. Burgess, M.D.
House of Representatives
The Honorable Diana DeGette
House of Representatives
Widespread use of electronic health information exchange has the
potential to improve the quality of health care provided in the United
States while reducing health care costs. This electronic transmission of
health information—such as health records, diagnoses, prescriptions, test
results, and images—occurs among health care providers and between
providers and patients. Electronic health information exchange can help
ensure health care providers have the tools and clinical information they
need to deliver more effective care, reduce medication errors and
duplicative testing, and improve public health reporting and monitoring.
While the goal of achieving widespread electronic health information
exchange has been pursued for years, it has proved challenging to
realize.
A variety of methods are used to electronically exchange health
information, including technology built into electronic health record (EHR)
systems as well as different processes used by organizations that
electronically move data among health care stakeholders (such as
laboratories, public health departments, hospitals, and physicians), which
are commonly referred to as health information exchange (HIE)
organizations. We have previously reported on challenges associated
with the various methods of exchange, including technical, financial, and
legal challenges. For example, we have issued three reports in recent
years that identified challenges related to matching patients to their
Letter
Page 2 GAO-23-105540 Electronic Health Information Exchange
records, the costs for updating or maintaining EHR systems, and
navigating variation in state privacy laws.
1
Enacted in 2009, the Health Information Technology for Economic and
Clinical Health (HITECH) Act provided about $35 billion to promote the
development and adoption of health information technology. This included
$2.4 billion in Medicaid payments paid to states through a matching
formula toward their efforts to support, improve, and advance electronic
health information exchange.
2
This funding sunsetted in 2021.
Throughout this report we refer to these payments as HITECH 90-10
funding. In this report, we describe
1. how states used HITECH 90-10 funding for health information
exchange efforts and states’ plans to replace those funds;
2. the extent to which and how the use of electronic health information
exchange has changed since the enactment of the HITECH Act; and
3. the federal efforts that aim to address key challenges to electronic
health information exchange.
To describe how states used HITECH 90-10 funding for health
information exchange efforts and states’ plans to replace those funds, we
obtained information and interviewed officials from the Centers for
Medicare & Medicaid Services (CMS) the agency within the Department
of Health and Human Services (HHS) that administered the provision of
HITECH 90-10 funding to the states.
3
Specifically, we obtained
information on the funds to support health information exchange efforts
1
See GAO, Health Information Technology: Approaches and Challenges to Electronically
Matching Patients’ Records across Providers, GAO-19-197 (Washington, D.C.: Jan. 15,
2019); Electronic Health Records: Nonfederal Efforts to Help Achieve Health Information
Interoperability, GAO-15-817 (Washington, D.C.: Sept. 16, 2015); and Electronic Health
Records: HHS Strategy to Address Information Exchange Challenges Lacks Specific
Prioritized Actions and Milestones, GAO-14-242 (Washington, D.C.: Mar. 24, 2014) .
2
Pub. L. No. 111-5, § 4201, 123 Stat. 115, 489 (2009). States and the federal government
share in the financing of the Medicaid program, with the federal government matching
most state expenditures for Medicaid services on the basis of a statutory formula known
as the Federal Medical Assistance Percentage. The HITECH Act authorized a federal
payment of Federal Medical Assistance Percentage of 90 percent for states’ costs related
to reasonable administrative expenses and planning activities related to encouraging the
adoption and use of certified EHR technology and the exchange of health care information
among Medicaid providers.
3
We use the term “states” to refer to the 50 states, District of Columbia, and five U.S.
territories.
Page 3 GAO-23-105540 Electronic Health Information Exchange
and to sustain these efforts beyond the availability of the HITECH 90-10
funding.
We also interviewed officials from the state agencies responsible for
administrating the HITECH 90-10 funding in seven states about how
HITECH 90-10 funds provided for health information exchange efforts
were actually used, the operation of HIE organizations in those states,
and how physicians in those states are exchanging health information.
The states were selected to account for variation in geographic location,
percent of hospitals connected to an HIE organization within the state,
and whether the state accessed HITECH 90-10 funding to support health
information exchange efforts, among other criteria.
4
We also conducted
interviews with representatives from a total of 10 HIE organizations
across the seven states.
5
We conducted interviews with stakeholders that
included national health information exchange networks, consortiums of
HIE organizations, and organizations representing providers, consumers,
HIE organizations, payers, and information technology professionals.
6
To describe the extent to which and how the use of electronic health
information exchange has changed since the enactment of the HITECH
Act, we reviewed data and reports from two national surveys.
• We reviewed data briefs on hospital use of electronic health exchange
published by HHS’s Office of the National Coordinator for Health
Information Technology (ONC) based on its analysis of annual data
from the 2014 through 2020 American Hospital Association (AHA)
Survey Information Technology Supplement of acute care hospitals.
7
4
The seven states were: Colorado, Georgia, Maryland, Minnesota, Missouri, Oklahoma,
and Washington.
5
We interviewed one HIE organization per state in Maryland, Minnesota, Oklahoma, and
Washington. We interviewed two HIE organizations per state in Colorado, Georgia, and
Missouri.
6
Throughout our report, we collectively refer to all of the interviewees as “stakeholders”
unless otherwise specified.
7
Acute care hospitals provide inpatient medical care and other related services for
surgery, acute medical conditions or injuries, usually for a short-term illness or condition.
All 6,165 acute care hospitals in the U.S. were surveyed, of which 2,871 responded.
According to ONC officials, due to pandemic-related delays, the 2020 AHA Survey
Information Technology Supplement survey (which is a supplement to the 2020 AHA
Survey) was not fielded on time. It was fielded from April 2021 through September 2021
and instructed respondents to answer questions as of the day the survey was completed.
Therefore, these data represent hospitals’ experiences in 2021 rather than 2020.
Page 4 GAO-23-105540 Electronic Health Information Exchange
We also obtained data from the 2020 survey to conduct additional
national and state-level analyses focused on, among other things, the
methods hospitals reported using to exchange health information.
8
• We also reviewed results from the National Electronic Health Records
Survey from 2018, 2019, and 2021 focused on office-based
physicians’ use of electronic health information exchange.
9
• We conducted interviews with, or obtained written responses from,
AHA and officials from ONC and the Centers for Disease Control and
Prevention (CDC) to learn about these data and their limitations and
determined they were reliable for the purposes of our reporting
objectives.
We also conducted interviews with state agencies in eight states—the
seven previously selected states plus New Hampshire, which did not
access HITECH 90-10 funding—and the 10 HIE organizations to learn
about the methods of exchange used in these states. We interviewed 12
physicians in six of our selected states and provider associations in two of
our selected states to learn about the methods they have used to
exchange health information. We identified these physicians through
outreach to the American Medical Association and state provider
associations affiliated with the American Medical Association, the
American Academy of Family Physicians, and the American College of
Physicians.
10
Interviews with physicians allowed us to identify concrete
examples, but these examples only reflect the experiences of those
physicians and are not intended to be generalizable.
8
According to AHA, these were the most recently available data at the time of our review.
The response rate for the most recent AHA Annual Survey Information Technology
Supplement was 47 percent. Findings from this survey may not be generalizable to all
hospitals (e.g., hospitals with limited information technology infrastructure), but they
illustrate experiences from a variety of hospitals.
9
The National Electronic Health Records Survey is an annual survey conducted by the
National Center for Health Statistics within the Centers for Disease Control and Prevention
(CDC). Data from 2018, 2019, and 2021 were the most recent available. According to
CDC officials, the survey was not conducted in 2020. Unweighted response rates for the
CDC surveys ranged from 36 percent to 47 percent from 2018 to 2021. Findings may not
be generalizable to all office-based physicians, but they illustrate different physician
experiences.
10
We contacted state provider associations in all eight states to identify physicians to
interview, but we were unable to identify physicians to interview in two states.
Page 5 GAO-23-105540 Electronic Health Information Exchange
To describe the key challenges that continue to affect electronic health
information exchange and the federal efforts to address these challenges,
we reviewed past GAO work on this topic, related federal laws and
regulations, and the Trusted Exchange Framework and the Common
Agreement (TEFCA) published by ONC, as required by the 21st Century
Cures Act.
11
We also reviewed data from both the 2020 AHA Annual
Survey Information Technology Supplement and the National Electronic
Health Records Survey from 2018 and 2019 on the challenges to
electronic health information exchange reported by hospitals and
physicians, respectively.
12
In all interviews conducted with state agency
officials, representatives of HIE organizations, physicians, and other
stakeholders, we asked about whether they encountered or were aware
of challenges that affected electronic health information exchange. We
also conducted interviews with officials or obtained written responses
from CDC, CMS, and ONC about the implementation of TEFCA and other
federal efforts, and the potential of these efforts to address the challenges
identified in the course of our review. In addition, in our interviews with an
industry expert and stakeholder organizations, we sought input on how
federal efforts might address the challenges identified.
13
Finally, to inform all three objectives, we conducted a literature search to
identify articles published between January 1, 2021 and April 21, 2022
that discussed electronic health information exchange.
14
We conducted this performance audit from November 2021 to April 2023
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
11
Pub. L. No. 114-255, § 4003(b), 130 Stat. 1033, 1165 (2016). TEFCA aims to describe a
common set of nonbinding, foundational principles for trust policies and practices that can
help facilitate exchange among health information networks.
12
The 2021 National Electronic Health Records Survey did not include questions about
barriers to health information exchange.
13
TEFCA had not been implemented at the time of our work. Therefore, stakeholders we
interviewed were only able to comment on what they anticipated the effect of TEFCA
might be once it was fully implemented.
14
We searched for a number of phrases starting with “health information exchange” and
with permutations using terms such as “rural health,” “rural,” “electronic health record,”
and “HITECH Act.” The search resulted in 172 references, which included scholarly or
peer reviewed material, conference proceedings, congressional hearings, reports,
dissertations, and books. Results were used as contextual information, specifically
regarding what we heard during interviews. Of the 172 references reviewed, we used 54
for our purposes.
Page 6 GAO-23-105540 Electronic Health Information Exchange
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Electronic health information exchange can occur through a variety of
organizations and methods.
15
Common organizations that facilitate
exchange include state, regional, or local HIE organizations and national
networks. Common methods used for exchange include software
solutions developed by private companies, such as those that support
EHR technology, EHR products, or interfaces developed to connect
different systems to each other, and electronic communications, such as
secure messaging and event notifications.
16
• State, regional, or local HIE organizations. HIE organizations are
entities that electronically move data among health care stakeholders,
such as laboratories, public health departments, hospitals, and
physicians. This exchange can be facilitated at the state, regional, or
local level, depending on the structure of each of the organizations.
For example, some states have one or more HIE organizations that
facilitate health information exchange statewide or for specific areas
15
In HHS regulation, ONC defines both a “health information exchange” and a “health
information network.” See 45 C.F.R. §171.102. The HHS definition states that a health
information exchange or health information network means an individual or entity that
determines, controls, or has the discretion to administer any requirement, policy, or
agreement that permits, enables, or requires the use of any technology or services for
access, exchange, or use of electronic health information: (1) Among more than two
unaffiliated individuals or entities that are enabled to exchange with each other; and (2)
That is for a treatment, payment, or health care operations purpose, as such terms are
defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
regardless of whether such individuals or entities are subject to the requirements of
HIPAA.
16
EHR technology is a type of health information technology used by healthcare providers
to create, store, and share electronic records of patient health information. The HITECH
Act established a definition for a “qualified EHR” (which ONC adopted as a “Base EHR” in
45 C.F.R. § 170.102) identifying key capabilities including to record and display patient
demographic and clinical health information, such as medical history and problem lists; to
provide clinical decision support; to support physician order entry; to capture and query
information relevant to health care quality; and to exchange electronic health information
with, and integrate such information from, other sources. EHR technology that meets such
a definition may be a combination of interconnected EHR products or a single EHR
product that supports the capabilities.
Background
Methods of Electronic
Health Information
Exchange
Page 7 GAO-23-105540 Electronic Health Information Exchange
of a state. In another example, an HIE organization may facilitate
exchange for multiple states in a region of the country.
• National health information exchange networks. These national
networks include multi-EHR developer networks, which can be used
to exchange health information among EHR technologies or products
connected to each other or HIE organizations. A national network can
facilitate query-based data exchange and enable connectivity by
providing the routing technology between and among existing health
information technology data exchange programs and platforms.
• EHR developer networks. In addition to electronically storing a
patient’s health information entered by the patient’s provider, EHR
developers may include functionality that facilitates the electronic
exchange of health information with other health care providers
across a network. These networks are generally developed to
exchange information between providers using an EHR system from
the same EHR developer. EHR developer networks may also be
referred to as EHR vendor-based networks.
• Point-to-point interfaces. Health care providers may have
customized interfaces developed to allow them to exchange patient
health information with specific providers or HIE organizations that
may or may not use the same EHR product. Such interfaces generally
only allow for exchange with a single entity outside of the provider’s
organization.
• Secure messaging. Secure messaging describes methods used by
health care providers and others to directly and securely send or
receive health information. There are different methods and
approaches for secure messaging, including the use of encryption.
Secure messaging capabilities may be included within EHR products,
or providers can access it as a separate service.
• Event notifications. These notifications may be generated by an HIE
organization and notify providers, sometimes in real time, of patient
interactions within the health care system. Such alerts can be
customized to be triggered for a defined event, such as the admission,
discharge, or transfer of a patient, or for a specific list of patients
meeting certain criteria (e.g., all patients in a practice who have a
diagnosis of heart failure).
Electronic health information exchange can occur in a variety of contexts
and settings. See figure 1 for examples.
Page 8 GAO-23-105540 Electronic Health Information Exchange
Figure 1: Electronic Health Information Exchange Scenarios
Page 9 GAO-23-105540 Electronic Health Information Exchange
We and others have previously reported on a number of challenges to
electronic health information exchange, including technical and financial
challenges, as well as challenges related to variation in privacy laws.
17
• Technical challenges. In prior work, we reported on insufficiencies in
health data standards, a lack of implementation and adoption of
standards for EHR and other health IT technologies, and difficulties
with accurately matching patients’ health records.
18
If the same sets of
standards are adopted by multiple different systems, it can facilitate
the exchange and interoperability of health information.
19
However,
variation in standards across systems can make electronic exchange
and interoperability of information exchanged between systems
difficult or even impossible, as data transmitted cannot be read by
systems receiving the information.
For example, if a standard is implemented by one health IT developer
such that it records or formats information differently from the way
another developer formats that information, it can result in providers
using those two different systems being unable to electronically
exchange information with each other. While some of the variation in
how information is formatted may be determined by developers, some
may result from requests made by providers for customization of their
EHR technology. In addition, because providers use different methods
to identify patients, a provider can encounter problems matching
information received from another provider to the correct patient.
Difficulty matching patients to their records can occur when
exchanging health information if, for example, demographic
17
See GAO-19-197, GAO-15-817, and GAO-14-242.
18
Standards are agreed-upon methods for connecting systems together. Standards may
pertain to security, data transport, data format or structure, or the meanings of codes or
terms. Health data standards are those that pertain to health-related information,
specifically.
19
EHR interoperability refers to the ability of EHR systems to exchange electronic health
information with other systems and process the information without special effort on the
part of the user, such as a health care provider. When EHR systems are interoperable,
information can be exchanged—sent from one provider to another—and then seamlessly
integrated into the receiving provider’s EHR system, allowing the provider to use that
health information to inform clinical care.
Longstanding Challenges
to Electronic Health
Information Exchange
Page 10 GAO-23-105540 Electronic Health Information Exchange
information used to match records is not consistently captured in all
records for a patient.
20
• Financial challenges. Our prior work has identified how the high
costs for purchasing an EHR system as well as EHR customization,
upgrades, and updates, and for legal fees can create barriers to
electronic health information exchange.
21
• Challenges related to state privacy laws. Our prior work and other
research have reported that the variation in state privacy rules, such
as those pertaining to patient consent for sharing health information,
created challenges for electronic health information exchange.
22
Navigating these laws can complicate the exchange of health
information across state borders. Various state laws govern the
disclosure of health information and may require a patient’s
permission before disclosing certain categories of information. Certain
providers may be subject to these state privacy laws in addition to the
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
and its implementing regulations.
23
20
Information such as a patient’s name, date of birth, phone number, or address may be
captured differently among providers. For example, one provider’s record may include
both first and middle name, while another’s may only include first name, or one may
include an outdated mailing address, and so on. If every provider does not capture this
demographic information in the same format, it may be difficult or impossible to match
patients’ records. See GAO-19-197, GAO-15-817, and GAO-14-242. See also D. Pai, B.
Rajan, and S. Chakraborty, “Do EHR and HIE Deliver on Their Promise? Analysis of
Pennsylvania Acute Care Hospitals,” International Journal of Production Economics, vol.
245 (2021).
21
See GAO-15-817 and GAO-14-242.
22
See GAO-15-817 and GAO-14-242. See also L. Lenert and B. Yeager McSwain,
“Balancing Health Privacy, Health Information Exchange, and Research in the Context of
the COVID-19 Pandemic,” Journal of the American Medical Informatics Association, vol.
27, no. 6 (2020): 963-966; N. Apathy and A. Holmgren, “Opt-in Consent Policies: Potential
Barriers to Hospital Health Information Exchange,” American Journal of Managed Care,
vol. 26, no. 1 (July 1, 2020).
23
HIPAA provides for the creation, enforcement, and monitoring of information security
and privacy standards for electronic health data. Pub. L. No. 104-191, Title II, Subtitle F,
110 Stat. 1936, 2021 (1996) as amended by the HITECH Act, Pub. L. No. 111-5, Title XIII,
123 Stat. 115, 226 (Feb. 17, 2009). The HIPAA Rules refer to regulations that implement
HIPAA promulgated at 45 C.F.R. Parts 160 and 164—the Privacy, Security, Enforcement,
and Breach Notification Rules. These regulations establish national standards to protect
individuals’ medical records and other individually identifiable health information. The
Privacy Rule sets limits and conditions on the use and disclosures of information that may
be made without an individual’s authorization.
Page 11 GAO-23-105540 Electronic Health Information Exchange
The HITECH Act included a number of provisions to authorize funding
and promote efforts to facilitate electronic health information exchange.
These included authorization of federal Medicaid matching funds for
electronic health information exchange activities and the Medicare and
Medicaid Electronic Health Record Incentive Programs. The federal
Medicaid matching funds, known as HITECH 90-10 funding, provided
funding to states at a 90-10 matching level (i.e., $90 federal dollars for
every $10 spent by the state). States could use these funds to support
health information exchange activities related to the Medicaid Electronic
Health Record Incentive Program, such as to design, develop, or
implement tools to connect HIE organizations; facilitate electronic lab
reporting; establish connections with immunization registries; fund HIE
organizations; and develop technical bridges between Medicaid systems
and HIE organizations.
24
This funding, which sunsetted in 2021, was not
intended to be the sole or primary source of funding for health information
exchange efforts. Before requesting these funds, states were required to
submit implementation plans to CMS that describe the health information
exchange efforts they anticipated supporting with these funds, anticipated
budgets for these efforts, and how they would sustain these efforts
beyond the availability of the HITECH 90-10 funding.
25
The Medicare and Medicaid Electronic Health Record Incentive Programs
were established in 2011 and provided incentive payments for certain
providers, such as eligible hospitals and physicians, to encourage them to
adopt, implement, and upgrade certified EHR technology to demonstrate
meaningful use of health information technology.
26
According to CMS, a
total of $28.7 billion in federal funds was provided in incentive payments
and for administrative costs related to these programs. Medicare
providers were eligible to receive incentive payments through 2016, and
24
We refer to this 90-10 Medicaid federal financial participation funding as HITECH 90-10
funding throughout this report.
25
See 45 C.F.R. §95.610. These implementation plans, referred to as Advanced Planning
Documents, are recorded plans of action to request federal funding approval for an IT
project supporting the Medicaid program. States can also use Advanced Planning
Documents to, for example, request that CMS review a contract or reallocate funds from a
preceding to a current fiscal year. CMS issued State Medicaid Director Letters #11-004
and #10-016, which include guidance on the types of health information exchange
activities for which states were able to request HITECH 90-10 administrative funding.
26
CMS and ONC have established standards and other criteria for structured data that
EHRs must meet. Structured data allows health care providers to easily retrieve and
transfer patient information and use the EHR in ways that can aid patient care.
Federal Efforts in Health
Information Exchange
Page 12 GAO-23-105540 Electronic Health Information Exchange
Medicaid providers were eligible through 2021. In 2018, CMS renamed
this effort the Medicare and Medicaid Promoting Interoperability
Programs. Participation was optional, but successful participants could
receive a payment adjustment based on their participation score. In 2022,
the Medicaid Promoting Interoperability Program ended, and the
Medicare Promoting Interoperability Program remains.
The 21st Century Cures Act of 2016 directed ONC to develop or support
a trusted exchange framework, including a common agreement among
health information networks nationally. TEFCA describes a common set
of nonbinding principles that can help facilitate exchange among health
information networks.
27
ONC, the federal agency implementing TEFCA,
aims for TEFCA to simplify connectivity for entities in order to increase
the electronic exchange of health information. Through TEFCA, ONC has
established Qualified Health Information Networks, organizations that will
connect directly to one another to facilitate the exchange of health
information among participants, which can include HIE organizations,
providers, and health systems. According to ONC, TEFCA is in the
process of being implemented by ONC and a Recognized Coordinating
Entity.
28
27
The Cures Act amended the Public Health Service Act to include this direction to ONC.
42 U.S.C. § 300jj-11(c).
28
In 2019, ONC awarded a cooperative agreement to the Sequoia Project to serve as the
Recognized Coordinating Entity for TEFCA. The Recognized Coordinating Entity is
responsible for developing, implementing, and maintaining the Common Agreement. In
conjunction with ONC, the Recognized Coordinating Entity will also designate and monitor
Qualified Health Information Networks. The Common Agreement is a legal contract that
ONC’s Recognized Coordinating Entity, the Sequoia Project, will sign with each Qualified
Health Information Network.
Page 13 GAO-23-105540 Electronic Health Information Exchange
According to CMS, 51 states used HITECH 90-10 funding to support
efforts related to electronic health information exchange.
29
CMS reported
that the plans submitted for how this funding would be used generally
included similar efforts, such as connecting providers with HIE
organizations (known as onboarding); supporting infrastructure for
electronic exchange, such as secure messaging; supporting public health
efforts; and supporting health information exchange services, such as
event notifications. See appendix I for more details on the plans
submitted by the 51 states.
Of the seven states in our review that accessed HITECH 90-10 funding,
officials from five states reported using some or all of the funds to pay HIE
organizations operating in their states to carry out health information
exchange activities, such as connecting providers to HIE organizations or
establishing exchange for public health efforts. See table 1 for more
details on how the seven states used these funds.
29
We use the term “states” to refer to the 50 states, District of Columbia, and five U.S.
territories. Illinois, New Hampshire, South Carolina, American Samoa, and Northern
Mariana Islands did not access this HITECH 90-10 funding.
Nearly All States
Used HITECH 90-10
Funding to Support
Electronic Health
Information
Exchange, and Most
Have Identified Other
Funding for the
Future
Nearly All States Used
HITECH 90-10 Funding to
Support Electronic
Exchange Efforts and
Fund HIE Organizations
Page 14 GAO-23-105540 Electronic Health Information Exchange
Table 1: Examples of Selected States’ Use of Health Information Technology for Economic and Clinical Health (HITECH) Act
90-10 Funding for Health Information Exchange Efforts
State Examples of health information exchange activities funded with HITECH 90-10 funding
Some or all of the
funding paid to HIE
organizations?
Colorado
•
Connected providers with and developing inoperability between health information
exchange (HIE) organizations
• Connected providers and others to public health registries
• Supported efforts related to consent management
• Funded Governor’s Office of eHealth Innovation
Yes (some)
Georgia
•
Conducted Electronic Health Record Incentive Program audits
• Conducted Medicaid provider outreach
• Developed query-based exchange services
• Conducted planning and development activities for health information exchange efforts
• Implemented secure messaging
Yes (some)
Maryland
•
Supported the development of clinical query portal
• Established encounter notification service to notify providers when a patient has been
hospitalized in any regional hospital
• Established public health reporting
Yes (all)
Minnesota
•
Established encounter notification service to notify providers when a patient has been
hospitalized
• Established connectivity with public health agency for public health reporting efforts
No
Missouri
•
Funded development of a statewide health information highway
• Provided onboarding assistance to help providers connect to HIE organizations in the
state
Yes (all)
Oklahoma
•
Implemented a provider onboarding program
• Established a provider portal
• Established exchange capabilities with the state’s Department of Health
Yes (all)
a
Washington
•
Built interfaces to facilitate health information exchange between health care providers
and other entities
• Funded behavioral health data exchange efforts
• Expanded access for rural health care providers
• Supported provider onboarding to a clinical data registry
• Supported data exchange with state immunization registry
• Modernized state health IT systems.
No
Source: GAO review of Centers for Medicare & Medicaid Services documents and interviews with state agency officials. | GAO-23-105540
a
In 2021, Oklahoma contracted with a technology vendor, which was expected to serve as the
statewide HIE organization, to carry out these activities. According to state officials, all of the state’s
HITECH 90-10 funding for health information exchange-related efforts was expended on this contract.
However, in 2021, another organization already in operation was designated to operate as the
statewide HIE organization.
Stakeholders we interviewed—including state agency officials,
representatives from HIE organizations, and groups representing HIE
Page 15 GAO-23-105540 Electronic Health Information Exchange
organizations—described the HITECH 90-10 funding as critical for
establishing and supporting the development of HIE organizations around
the country. In addition, studies we reviewed found that most HIE
organizations were established after the enactment of the HITECH Act,
and that the HITECH 90-10 funding was significant both for establishing
HIE organizations and motivating providers to work with HIE
organizations to exchange health information.
30
According to information provided by CMS, 50 of the 51 states that
accessed HITECH 90-10 funding for health information exchange efforts
have identified other potential funding sources to sustain those efforts
following the sunsetting of the HITECH 90-10 funding in 2021. CMS
officials reported that as of December 2022, 29 of the 51 states had
already requested Medicaid Enterprise Systems funding.
31
State agency
officials in all seven states we reviewed that had received HITECH 90-10
funds stated that they were either already receiving or were in the
process of applying for Medicaid Enterprise Systems funds as a means
for sustaining health information exchange efforts formerly funded
through HITECH.
States reported to CMS that they will pursue a variety of other
approaches to sustain health information exchange efforts previously
funded by HITECH 90-10 funding, including provider or payer
subscription fees, state funding, grants, or donations. State officials,
representatives from HIE organizations, and other stakeholders we
interviewed also described various approaches to sustaining these
efforts. For example, HIE organizations and state agencies stated that
30
H. Atasoy, E. Demirezen, and P. Chen, “Impacts of Patient Characteristics and Care
Fragmentation on the Value of HIEs,“ Production and Operations Management, vol. 30,
no. 2 (Feb. 2021); E. Nahm et al, “Health Information Exchange: Practical Overview and
Implications for Nursing Practice,” The Journal of Nursing Administration, vol. 50, no. 11
(Nov. 2020): 584-589; J. Pendergrass and C. Ranganathan, “Institutional Factors Affecting
the Electronic Health Information Exchange by Ambulatory Providers,” Health Policy and
Technology, vol. 10, no. 4 (Oct. 9, 2021).
31
Medicaid Enterprise Systems funding is federal funding provided to states to support
modular, flexible, upgradeable systems for state Medicaid agencies and their users for
activities such as reporting and fraud detection, checking beneficiary eligibility, and
Medicaid beneficiary care management. CMS determined that states were able to request
Medicaid Enterprise Systems funding for some efforts previously supported through
HITECH Act funding for HIE-related activities. In addition, one territory (Northern Mariana
Islands) and one state (New Hampshire) that had not requested HITECH 90-10 funds for
health information exchange efforts requested Medicaid Enterprise Systems funds for
these purposes.
Most States Have
Identified Other Funding
Sources to Sustain Health
Information Exchange
Efforts Formerly Funded
by HITECH
Page 16 GAO-23-105540 Electronic Health Information Exchange
they planned to pursue or were already accessing other state or federal
funding to support exchange activities. They also said they planned to
charge or were already charging subscription fees for providers,
researchers, and state agencies to use their health information exchange
services as a way to sustain activities previously funded under HITECH.
In addition, some HIE organizations described plans to use subscription
fees from commercial payers to help sustain health information exchange
activities; in exchange, those payers would obtain access to certain
health information or electronic exchange services.
HIE organizations have also described taking steps to maintain their
operations. A group representing HIE organizations and studies we
reviewed noted that HIE organizations need to offer additional services of
value to their customers in order to be sustainable.
32
Officials we
interviewed from HIE organizations described how they are providing
services that include data analytics, data exchange connections with
public health entities, connections with social service referral agencies,
and data for payers to use in claims processing. In addition,
representatives we interviewed from five HIE organizations stated that
they had either recently merged with another HIE organization or were
planning to do so as a means to sustain their operations. Stakeholders
described how merging with other HIE organizations allowed or would
allow them to save money through the consolidation of technical
infrastructure or legal staff.
Finally, several stakeholders described how HIE organizations are
pursuing a health data utility model as a way to be an entity that provides
more than just the exchange of clinical data between providers. Under
this type of model, HIE organizations would combine, enhance, and
exchange electronic health data across care and service settings for
treatment, care coordination, quality improvement, and public and
community health purposes through specific, defined use cases in
accordance with applicable state and federal laws protecting patient
privacy.
32
N. Yaraghi, S. Lai, “Maintaining Health Information Exchange Competitiveness in a New
Market.” Brookings Institute, (Oct. 7, 2021); J. Adler-Milstein et al, “A Survey of Health
Information Exchange Organizations In Advance of a Nationwide Connectivity
Framework,” Health Affairs, vol. 40, no. 5 (May 2021).
Page 17 GAO-23-105540 Electronic Health Information Exchange
National surveys of both hospitals and office-based physicians have
shown increases in the electronic sending and receiving of patient health
information in recent years. For example, according to ONC analyses of
AHA Annual Survey Information Technology Supplement survey data, the
percentage of hospitals that reported either “sometimes” or “often” using
electronic methods to send patient health information increased from 78
percent in 2014 to 91 percent in 2021, and the percentage that reported
either “sometimes” or “often” receiving patient information electronically
increased from 56 percent in 2014 to 85 percent in 2021.
33
Similarly,
according to weighted results of the National Electronic Health Records
Survey of office-based physicians reported by the CDC, the percentage of
physicians that reported they electronically send patient health
information to providers outside of their medical organization using an
EHR product or web portal (separate from their EHR product) increased
from 29 percent in 2018 to 39 percent in 2021, and the percentage that
reported receiving patient health information that way increased from 34
percent in 2018 to 53 percent in 2021.
Stakeholders we interviewed also described how the electronic exchange
of health information has increased over time, with providers now
generally having multiple methods available to them—such as HIE
organizations, EHR developer networks, event notifications, and log-in
credentials for hospitals’ or health systems’ EHRs. Some stakeholders
noted improvements in the ability to exchange directly between EHR
systems when providers had the same EHR product. Some also noted
33
According to ONC officials, the 2020 AHA Annual Survey Information Technology
Supplement was fielded from April 2021 to September 2021. Respondents were asked to
answer the survey questions as of the day the survey was completed, which included their
experiences from 2020. Responses were based on the frequency with which a hospital
used the various exchange methods, and these were: often, sometimes, rarely, never, and
do not know/NA. ONC’s analysis of these data was reported in a data brief issued in 2023.
See Y. Pylypchuk and J. Everson, “Interoperability and Methods of Exchange among
Hospitals in 2021,” ONC Data Brief, no. 64, Office of the National Coordinator for Health
Information Technology (Washington, D.C.: Jan. 2023).
Use of Electronic
Health Information
Exchange Has
Increased but Is
Lower for Small and
Rural Providers
While Electronic Exchange
Has Increased, Use
among Small and Rural
Hospitals and Office-
Based Physicians Was
Lower
Page 18 GAO-23-105540 Electronic Health Information Exchange
that electronic exchange was occurring more among large hospitals or
health systems and physicians affiliated with large hospitals or health
systems. In addition, some stakeholders noted that providers, including
physicians, often use multiple forms of both electronic and non-electronic
exchange, and that the methods of exchange they use are often affected
by factors such as whether they are connected to an HIE organization,
the electronic capabilities of organizations they exchange information
with, and the information being exchanged.
While there were overall increases in the use of electronic exchange,
including among small and rural hospitals, our analysis of the AHA
Survey Information Technology Supplement data found that, as of 2021,
small hospitals’ and rural hospitals’ reported use of electronic methods of
health information exchange lagged behind larger and non-rural
hospitals.
34
While ONC reported that electronic exchange had increased
among small hospitals and rural hospitals in recent years, it noted that
these providers continue to engage in electronic exchange at rates lower
than larger and non-rural hospitals.
35
Furthermore, our review of these
data found that the percentages of small hospitals that reported “often”
using an HIE organization, EHR vendor-based network, or national
network to electronically exchange health information were less than the
percentages reported by medium and large hospitals.
36
In addition, the
percentage of rural hospitals that reported they “often” used fax or mail to
exchange patient health information was higher than the percentage
reported by non-rural hospitals (see fig. 2).
34
“Small hospitals” refers to hospitals with bed sizes of 100 or less. Rural hospitals are
those hospitals located in a non-metropolitan statistical area.
35
Y. Pylypchuk and J. Everson, “Interoperability and Methods of Exchange among
Hospitals in 2021,” ONC Data Brief, no. 64, Office of the National Coordinator for Health
Information Technology (Washington, D.C.: Jan. 2023).
36
Responses were based on the frequency with which a hospital used the various
exchange methods, and these were: often, sometimes, rarely, never, and do not know/NA.
Page 19 GAO-23-105540 Electronic Health Information Exchange
Figure 2: Exchange Methods Often Used among Hospitals, by Characteristic, 2021
Note: Of the 6,165 acute care hospitals in the U.S. that were surveyed, 2,871 responded to the 2020
American Hospital Association Annual Survey Information Technology Supplement. According to
ONC officials, due to pandemic-related delays, the 2020 AHA Survey Information Technology
Supplement survey (which is a supplement to the 2020 AHA Survey) was not fielded on time. It was
fielded from April 2021 through September 2021 and instructed respondents to answer questions as
of the day the survey was completed. Therefore, these data represent hospitals’ experiences in 2021
rather than 2020. Responses were based on the frequency with which a hospital used the various
exchange methods, and these were: often (as shown in the figure), sometimes, rarely, never, and do
not know/NA. Findings from this survey may not be generalizable to all hospitals (e.g., hospitals with
limited information technology infrastructure), but they illustrate experiences from a variety of
hospitals.
Stakeholders noted that small and rural providers, as well as those not
affiliated with a large hospital or health system, were less likely to have
the financial or technological resources to participate in an HIE
Page 20 GAO-23-105540 Electronic Health Information Exchange
organization or purchase or maintain an EHR system capable of
electronic exchange. As a result, some noted that such providers were
more likely to rely on mail or fax to exchange patient information than
electronic methods. All 12 physicians we interviewed said they used fax
to send or receive patients’ health information. Of those, 11 physicians
said they often used fax rather than electronic methods to exchange
patient health information, including one physician whose practice was
also connected to an HIE organization and an EHR developer network.
The twelfth physician noted using an EHR developer network to
exchange information and only using fax with other providers who did not
have the same EHR developer.
Hospitals’ use of electronic health information exchange methods may be
influenced by a variety of factors, including state-specific factors such as
state laws or the prevalence of a particular exchange method. Our review
of the AHA Annual Survey Information Technology Supplement survey
data for the eight selected states found that, as of 2021, hospitals’ use of
non-electronic and electronic health information exchange methods
varied. For example, in Maryland, a state law requires all hospitals, with
some exceptions, to use the state’s single HIE organization.
37
Among the
eight states, Maryland hospitals “often” used HIE organizations to
exchange information at the highest rate. According to Washington state
agency officials, the state did not use any of its HITECH 90-10 funding to
pay HIE organizations, and among the eight states, the percentage of
hospitals that reported “often” using HIE organizations to exchange
information was lowest in Washington. In Colorado and Minnesota, we
found that most hospitals used the same EHR developer. When
compared with the other six selected states, a higher percentage of
hospitals in Minnesota and Colorado reported “often” exchanging
information using EHR vendor-based networks. New Hampshire had
among the lowest utilization of HIE organizations and national networks
and was the only selected state that did not access HITECH 90-10
funding (see fig. 3).
38
37
Md. Code Ann., Health - General, § 19-145 (2022).
38
We analyzed AHA Annual Survey Information Technology Supplement survey data and
found that, as of 2021, a majority of hospitals in Colorado and Minnesota used the same
EHR product from the same EHR developer. While this product was the leading EHR
product in the other six selected states, it was not used by a majority of hospitals in any of
those states.
Hospitals’ Use of
Electronic Health
Information Exchange
Methods May Be
Influenced by State-
Specific Factors
Page 21 GAO-23-105540 Electronic Health Information Exchange
Figure 3: Exchange Methods Often Used by Hospitals in Selected States, 2021
Note: Numbers shown under each state indicate the total number of hospitals in each state that
responded to the American Hospital Association Annual Health Information Technology Supplement,
2020. Of the 6,165 acute care hospitals in the U.S. that were surveyed, 2,871 responded to the
American Hospital Association Annual Survey Information Technology Supplement. According to
Page 22 GAO-23-105540 Electronic Health Information Exchange
ONC officials, due to pandemic-related delays, the 2020 AHA Survey Information Technology
Supplement survey (which is a supplement to the 2020 AHA Survey) was not fielded on time. It was
fielded from April 2021 through September 2021 and instructed respondents to answer questions as
of the day the survey was completed. Therefore, these data represent hospitals’ experiences in 2021
rather than 2020. Respondents were asked to answer the survey questions as of the day the survey
was completed, which included their experiences from 2020. Responses were based on the
frequency with which a hospital used the various exchange methods, and these were: often (as
shown in the figure), sometimes, rarely, never, and do not know/NA. Findings from this survey may
not be generalizable to all hospitals (e.g., hospitals with limited information technology infrastructure),
but they illustrate experiences from a variety of hospitals.
Stakeholders we interviewed described how electronic health information
exchange has been used to support research, payer activities, and public
health efforts. In addition, electronic health information exchange
facilitated states’ response to the COVID-19 pandemic.
• Research efforts. Representatives of four HIE organizations we
interviewed said their organizations collect data for or connect to
clinical data registries, including cancer, Alzheimer’s, and stroke
registries.
39
The information is made available to paying subscribers,
including those conducting research on these diseases. A
representative of another HIE organization explained that their
organization analyzes the data to support research studies for several
federal agencies and institutions.
• Payer activities. Representatives from five of the 10 HIE
organizations we interviewed noted that payers use or would
eventually be able to use their electronic health information exchange
services. Payers that participate in HIE organizations pay subscription
fees to obtain the organizations’ services. According to an association
that represents payers, payers are interested in connecting to HIE
organizations and using patients’ health data to support their
administrative activities, such as processing prior authorizations.
40
• Public health efforts. Representatives from seven HIE organizations
we interviewed noted that electronic health information exchange
through their organizations supports various public health efforts, such
as exchanging data with state immunization registries, supporting
39
Clinical data registries are entities that collect and analyze detailed information on the
therapies that patients receive and changes in their clinical condition over time in order to
evaluate and improve care practices and outcomes. See GAO, Clinical Data Registries:
HHS Could Improve Medicare Quality and Efficiency through Key Requirements and
Oversight, GAO-14-75 (Washington, D.C.: Dec. 16, 2013).
40
A physician and an organization representing physicians expressed concern about
payers having access to such data.
Electronic Health
Information Exchange
Facilitates Research and
Public Health Efforts
Page 23 GAO-23-105540 Electronic Health Information Exchange
prescription drug monitoring programs, and facilitating disease
reporting to public health entities
41
Public health agencies and
providers may pay subscription fees to connect to these HIE
organizations and can use the information to monitor public health
emergencies.
• States’ response to the COVID-19 pandemic. According to state
officials, six of the seven states we reviewed that received HITECH
90-10 funding for electronic health information exchange used HIE
organizations specifically to respond to the COVID-19 pandemic. For
example, representatives from one HIE organization described how
they developed data exchange feeds with laboratories to facilitate
contact tracing and referrals for testing services at the beginning of
the pandemic. In addition, representatives from seven HIE
organizations we interviewed described how their organizations
provided assistance to state agencies during the COVID-19
pandemic, such as by using data to help state agencies develop
dashboards for public reporting or aggregate data to monitor
hospitalization rates throughout the state. Representatives from state
agencies and HIE organizations also told us that public health
agencies were able to more easily access COVID-19 testing and
vaccination data through HIE organizations that facilitated exchange
between laboratory facilities, providers, and public health agencies.
42
Similarly, CDC officials stated that they are collaborating with several
state and regional HIE organizations on electronic reporting of
COVID-19 cases, and HIE organizations have helped communicate
with providers about the importance of electronic case reporting and
41
Prescription drug monitoring programs are state-run electronic databases that allow
health care providers, such as physicians and pharmacists, to review information on
prescriptions for opioids and other controlled substances that their patients have
previously received. See GAO, Prescription Drug Monitoring Programs: Views on
Usefulness and Challenges of Programs, GAO-21-22 (Washington, D.C.: Oct. 1, 2020).
42
Studies we reviewed described how the COVID-19 pandemic had demonstrated the
importance of HIE organizations and electronic health information exchange generally,
such as for forecasting health care facility needs, developing data dashboards, helping
hospitals improve care for patients with COVID-19, and tracking immunization data. S.
Madhavan et al, “Use of Electronic Health Records to Support a Public Health Response
to the COVID-19 Pandemic in the United States: A Perspective from 15 Academic Medical
Centers,” Journal of the American Medical Informatics Association, vol. 28, no. 2 (Nov.
2020): 393-401; V. O’Reilly-Shah et al, “The COVID-19 Pandemic Highlights
Shortcomings in US Health Care Informatics Infrastructure: A Call to Action.” The Open
Mind (missing publisher and date), DOI: 10.1213 (2020); J. Ye, “The Role of Health
Technology and Informatics in a Global Public Health Emergency: Practices and
Implications from the COVID-19 Pandemic.” JMIR Medical Informatics, vol. 8, no. 7 (Jul.
2020): e19866, DOI:10.2196/19866; M. Caruso, “Effective Data Exchange Leads to
Effective Care.” Modern Healthcare, vol. 51, no. 25 (Sept. 2021): 57.
Page 24 GAO-23-105540 Electronic Health Information Exchange
served as a means for connecting providers to CDC when in need of
assistance with such efforts.
HHS efforts such as TEFCA may address some long-standing
impediments to electronic health information exchange. In addition, while
federal efforts have sought to address privacy concerns, the variation in
state privacy laws continues to present challenges to electronic
exchange.
ONC officials described how TEFCA has the potential to address some of
the technical challenges that affect electronic health information
exchange, specifically the inconsistent implementation of standards and
patient matching. ONC officials stated that TEFCA’s standards-based
approach to electronic exchange, which includes requiring Qualified
Health Information Networks and their participants to adhere to certain
standards for exchanging health information, should promote more
consistent implementation of standards and improve exchange and the
interoperability of information exchanged (see sidebar on Principle 1,
Standardization).
ONC officials also stated that TEFCA could improve patient matching, as
it will standardize the patient demographic information exchanged and
used to match patients to their health records (see sidebar on Principle 4,
Patient Matching).
43
While some stakeholders acknowledged that
standardization principles in TEFCA hold potential for improving
electronic exchange in the long run, including for patient matching, others
expressed concern that initially, as a larger volume of patients’ health
information is shared and accessed, the opportunities for patient
matching errors could increase. However, ONC officials noted that
requirements within the TEFCA technical framework would help to reduce
the potential risks associated with an increase in data exchange, which
they said is one of the advantages of using TEFCA to expand health
information exchange capabilities as compared with expansion under the
current paradigm without TEFCA.
43
We reported in 2019 that stakeholders described how TEFCA could potentially improve
patient record matching if, for example, it resulted in new guidance or standards about
demographic data elements. See GAO-19-197.
HHS Efforts such as
TEFCA May Address
Some Persistent
Impediments to
Electronic Health
Information Exchange
Federal Efforts May
Address Some Technical
Impediments
Principle 1 of the Trusted Exchange
Framework – Standardization
The Trusted Exchange Framework and
Common Agreement requires that participants
use federally adopted health information
technology standards and implement those
standards in accordance with direction from
standard development organizations in order
to minimize variation in how they are used.
Source: GAO analysis of information from the U.S.
Department of Health and Human Services, Office of the
National Coordinator for Health Information Technology
(information); GAO (image). | GAO-23-105540
Page 25 GAO-23-105540 Electronic Health Information Exchange
Two stakeholders stated that patient matching has improved in recent
years due to improvements in technology and efforts undertaken by HIE
organizations to implement technology to address this issue. However,
other stakeholders, including HIE organizations, state agencies, and
provider associations, described how it continues to be a challenge. For
example, some noted that the lack of a national patient identifier or
technology to manage patient identification hinders the ability of providers
to consistently identify the correct information for each patient.
44
Recent
studies also continued to cite patient matching as a barrier.
45
In addition,
HIE organizations and other stakeholders expressed concerns that
TEFCA could potentially interrupt HIE organizations’ business models as
a result of providers opting to connect only to Qualified Health Information
Networks and stop paying to connect to state or local HIE organizations.
This transition could also potentially negatively affect providers that rely
on HIE organizations’ services, such as for facilitating patient matching.
However, ONC officials told us they thought HIE organizations would
benefit from TEFCA’s technical infrastructure.
Stakeholders we interviewed, including representatives from state
agencies and HIE organizations, also noted that broadband access and
availability in rural communities had improved in recent years, primarily
due to federal and state efforts aimed at expanding broadband. However,
they noted that despite these efforts, lack of broadband access,
particularly in very rural areas of the country, continues to be an
impediment to electronic exchange.
44
In previous work, we described how stakeholders noted that implementing a national,
unique patient identifier specifically for use in health care settings could improve the ability
to match patients’ medical records. For example, having a new, unique number assigned
to an individual would reduce the reliance on demographic data for record matching. See
GAO-19-197. HHS stated that, since fiscal year 1999, Congress has prohibited the
implementation of a national patient identifier. The restriction, first enacted under the
Omnibus Consolidated and Emergency Supplemental Appropriations Act of 1999,
prohibits HHS from using any funds to promulgate or adopt any final standard providing
for, or providing for the assignment of, a unique health identifier for an individual until
legislation is enacted specifically approving the standard. See Consolidated
Appropriations Act, 2023, Pub. L. No. 117-328, § 510, 136 Stat. 4459, 4909 (2022).
45
Our review of the AHA Survey Information Technology Supplement survey data found
that, as of 2021, 48 percent of hospitals responded that patient matching was a barrier to
electronically receiving patient information (out of 2,871 respondents). See also J. Adler-
Milstein et al., “A Survey of Health Information Exchange Organizations in Advance of a
Nationwide Connectivity Framework.” Health Affairs, vol. 40, no. 5 (May 2021): 736-744;
D. Pai, B. Rajan, and S. Chakraborty, “Do EHR and HIE Deliver on Their Promise?
Analysis of Pennsylvania Acute Care Hospitals,” International Journal of Production
Economics, vol. 245 (Dec. 24, 2021).
Principle 4 of the Trusted Exchange
Framework – Patient Matching
To support accurate patient matching, such as
when exchanging patients’ health information
between electronic health record (EHR)
systems, the Trusted Exchange Framework
and Common Agreement (TEFCA) requires
that Qualified Health information Networks
agree upon and consistently share a core set
of demographic data each time health
information is exchanged. In addition, other
TEFCA participants are expected to ensure
that this core set of demographic data are
consistently captured in order to help facilitate
the accurate matching of patient records
based on that demographic information.
Source: GAO analysis of information from the U.S.
Department of Health and Human Services, Office of the
National Coordinator for Health Information Technology
(information); GAO (image). | GAO-23-105540
Page 26 GAO-23-105540 Electronic Health Information Exchange
Stakeholders described how two separate federal efforts have helped or
have the potential to help address financial challenges to electronic health
information exchange. First, state agency officials, representatives from
HIE organizations, and other stakeholders noted that the funding made
available through the HITECH Act, including EHR incentive payments and
90-10 funding for health information exchange efforts, helped mitigate or
support some of the costs related to electronic exchange and helped
providers acquire EHR systems they can use for electronic exchange.
However, some stakeholders noted that health care providers that were
not eligible to receive incentive payments, including behavioral health
providers and long-term care facilities, or did not otherwise participate in
the EHR Incentive Programs often still lacked EHR systems or EHR
systems capable of electronic exchange.
Second, ONC officials described how TEFCA could potentially address
some of the financial challenges that providers face. For example,
officials noted that TEFCA would reduce the number of connections
needed to exchange health information between providers and other
network participants. As a result, once implemented, participating
providers would have a reduced need to develop costly interfaces or
connections to exchange information with multiple other health care
providers. ONC officials and stakeholders also noted that this could be
particularly helpful for small providers or those that serve rural areas of
the country, as it would make exchange less costly and give providers
potentially more options. However, some stakeholders representing
health IT professionals and payers noted that because participation in
TEFCA is voluntary, this benefit would depend on the extent of
participation. Stakeholders we interviewed also noted that it is not yet
clear how TEFCA will be financially sustained and what fees providers
and other network participants will need to pay to participate in TEFCA.
Stakeholders also described how, at the time of our interviews, costs
related to electronic health information exchange continued to be a
challenge, particularly for small and rural providers. For example, they
described how the costs for updating EHR systems or developing
interfaces was a significant challenge to providers’ ability to electronically
exchange health information, because they often lacked financial
Federal Efforts May Help
Mitigate Costs, but
Financial Challenges
Persist, Particularly for
Small and Rural Providers
Page 27 GAO-23-105540 Electronic Health Information Exchange
resources to afford more advanced EHR systems or pay for additional
features to be added to their system. One physician we spoke with who
runs a private practice told us that the EHR system the practice
purchased about a decade ago was outdated, and the practice cannot
afford to invest in a new, more advanced system capable of exchange. As
a result, the practice uses its system for management of its own health
information, but is not able to use it to electronically send or receive
health information to others.
Additionally, stakeholders we interviewed also described how the cost
and availability of health IT staff was a barrier to electronic exchange. A
wide range of stakeholders we interviewed, including representatives
from HIE organizations and state agencies and providers described how
they often struggle to afford or find staff with health IT knowledge to
support an infrastructure that is capable of electronic exchange,
particularly in rural areas of the country. In a 2019 CDC survey of office-
based physicians, 43 percent responded that the lack of health IT staff
was a barrier in their ability to electronically exchange health information.
Studies we reviewed noted that rural clinics in particular were often
understaffed or lacked staff with the necessary health IT expertise to
facilitate electronic health information exchange.
46
Two federal efforts could address some challenges to electronic health
information exchange related to privacy laws. First, ONC officials noted
that TEFCA uses HIPAA, or terms that are substantially similar to HIPAA,
as the privacy baseline that all network participants must adhere to,
including participants not otherwise legally covered under HIPAA (see
sidebar on Principle 4, HIPAA). They noted that the use of this privacy
baseline could potentially improve the privacy of the health data
exchanged.
47
Officials also described how TEFCA introduced additional
requirements of Individual Access Service Providers to protect privacy
and security, including the requirement for data to be encrypted and the
right to delete data upon request. Representatives we interviewed from a
46
B. Sutherland et al., “Expect Delays: Poor Connections between Rural and Urban Health
Systems Challenge Multidisciplinary Care for Rural Americans with Diabetic Foot Ulcers,”
Journal of Foot and Ankle Research, vol. 13, no. 32 (2020); L. Peters, “How HIEs Can
Help Improve Care in Rural Communities,” Journal of AHIMA (Sept. 13, 2021).
47
ONC explained that this includes third-party applications that access patient health
information that is exchanged on TEFCA’s network. ONC stated that this could improve
security of data exchanged by third-party applications that access patient health
information exchanged on TEFCA’s network, as third-party developers may not generally
be covered under the HIPAA Privacy and Security Rules.
Federal Efforts May Help
Protect Privacy, but
Variation in State Privacy
Laws Remains a
Challenge
Page 28 GAO-23-105540 Electronic Health Information Exchange
provider association expressed concern that TEFCA will broaden the
scope of the entities that can access patient data. In addition, a number of
stakeholders we interviewed noted that misunderstandings of HIPAA
continue to pose challenges to electronic health information exchange as
providers may incorrectly believe the law prohibits them from sharing
certain information.
48
Second, in November 2022, HHS released a proposed rule for comment
that intends to better align HHS regulations protecting the confidentiality
of substance use disorder patients, known as 42 CFR Part 2 or Part 2,
with HIPAA.
49
Under current regulations, different requirements apply to
the disclosure of substance use disorder treatment records protected by
Part 2 than HIPAA applies to protected health information. According to
HHS, the proposed rule, developed in response to a provision in the
CARES Act that requires HHS to bring Part 2 into greater alignment with
HIPAA, aims to address challenges providers encounter when
exchanging data covered under Part 2 and improve coordination.
50
A
number of stakeholders we interviewed described how the current Part 2
regulations create a challenge to health information exchange, as
information about a patient’s substance use disorder diagnosis or
treatment cannot always be easily segmented from other health
information being exchanged. Some stakeholders noted that this made it
particularly difficult for behavioral health providers to engage in electronic
health information exchange.
Stakeholders also described how variations in state privacy laws
continued to be a hindrance when electronically exchanging health
information. For example, stakeholders, including HIE organizations and
provider associations, noted that the variations in state privacy laws made
it difficult to exchange health information across state lines or work with
HIE organizations in other states. States may vary in terms of what
information can be exchanged, and it can be hard to comply with multiple
sets of laws or laws that do not align with one another. Studies we
48
In a 2020 AHA survey of hospitals, 49 percent cited privacy laws, such as HIPAA, as a
barrier to electronically receiving health information.
49
See 87 Fed. Reg. 74,216 (Dec. 2, 2022). 42 C.F.R. Part 2 prohibits federally-assisted
substance use disorder treatment programs from disclosing patient records that would
identify a patient as having or having had substance use disorder without the patient’s
consent.
50
See CARES Act, Pub. L. No. 116-136, div. A, § 3221,134 Stat. 281, 375-76 (2020).
Principle 4 of the Trusted Exchange
Framework – HIPAA
While most health care providers and other
health care entities must follow the Health
Insurance Portability and Accountability Act of
1996 (HIPAA) Rules to safeguard information,
the Trusted Exchange Framework and
Common Agreement (TEFCA) recognizes that
digital health information is increasingly
collected, shared, or used by new types of
organizations that are not covered by the
HIPAA Rules. To protect the privacy and
security of health information, TEFCA requires
that all TEFCA participants adhere to rules
that are substantially similar to HIPAA,
including those participants that are not
HIPAA-covered entities. However, this does
not mean that those non-covered entities are
not subject to all the requirements of HIPAA.
Source: GAO analysis of information from the U.S.
Department of Health and Human Services, Office of the
National Coordinator for Health Information Technology
(information); GAO (image). | GAO-23-105540
Page 29 GAO-23-105540 Electronic Health Information Exchange
reviewed identified how variations in state privacy laws, specifically the
effect of state laws on information exchange and management of patient
consent, can be a barrier to health information exchange.
51
We provided a copy of the draft report to HHS for review and comment.
HHS provided technical comments, which we incorporated as
appropriate.
We are sending copies of this report to the appropriate congressional
committees, the Secretary of Health and Human Services, and other
interested parties. In addition, the report is available at no charge on the
GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact
me at (202) 512-7114 or [email protected]. Contact points for our
Offices of Congressional Relations and Public Affairs can be found on the
last page of this report. Major contributors to this report are listed in
appendix II.
Leslie V. Gordon
Director, Health Care
51
Lenert and McSwain, “Balancing Health Privacy,” Apathy and Holmgren, “Opt-in
Consent Policies.”
Agency Comments
Appendix I: States’ Use of HITECH Act
90-10 Funding for Health Information
Exchange Activities
Page 30 GAO-23-105540 Electronic Health Information Exchange
Table 2 shows the activities that states receiving Health Information
Technology for Economic and Clinical Health Act (HITECH Act) funding
for health information exchange efforts had planned.
1
In total, 51 states
requested and received HITECH 90-10 funding for health information
exchange activities.
2
The information presented in table 2 is based on
information aggregated by the Centers for Medicare & Medicaid Services
(CMS) in its review of states’ written plans. However, states’ actual
activities may have varied from their submitted plans. To the extent
possible, we corroborated the information from CMS with written plans we
reviewed from seven selected states and interviews with agency officials
in those states.
Table 2: Number of States Receiving Health Information Technology for Economic and Clinical Health Act (HITECH Act)
Health Information Exchange Funding that Reported Plans for Specific Activities
General activity Specific activity
Number of states that reported plans to use
HITECH health information exchange-
related
funding for that activity
Onboarding providers
General onboarding
42
Communications
15
Outreach and marketing
33
Training and education
28
Eligible hospital onboarding
23
Eligible professional onboarding
22
Other clinical provider onboarding
23
Other nonclinical provider onboarding
12
Public health
Nonspecific public health activities
32
Immunization registry
36
Cancer registry
17
Syndromic surveillance
22
Specialized registry
29
Electronic lab reporting
28
Prescription drug monitoring program
31
Health information exchange
infrastructure
General infrastructure
47
Service access layer
14
Secure messaging
20
1
We use the term “states” to refer to the 50 states, District of Columbia, and five U.S.
territories.
2
Illinois, New Hampshire, South Carolina, American Samoa, and Northern Mariana
Islands did not access HITECH 90-10 funding for health information exchange activities.
Appendix I: States’ Use of HITECH Act
90-10 Funding for Health Information
Exchange Activities
Appendix I: States’ Use of HITECH Act
90-10 Funding for Health Information
Exchange Activities
Page 31 GAO-23-105540 Electronic Health Information Exchange
General activity Specific activity
Number of states that reported plans to use
HITECH health information exchange-
related
funding for that activity
Health information exchange
infrastructure
Master provider index
17
Master patient index
27
Single sign on
15
Community record
14
Nationwide Health Information Network or
other gateway
20
Health information exchange
services
General service-related activities
40
Reporting
34
Electronic clinical quality measure collection
efforts
20
Direct messaging
23
Electronic prescribing
4
Query based exchange
29
Event notification
37
Planning
General planning
40
Vendor contracting
44
Source: GAO review of Centers for Medicare & Medicaid Services documents. | GAO-23-105540
Note: The term “states” refers to the 50 states, District of Columbia, and five U.S. territories.
Appendix II: GAO Contact and Staff
Acknowledgments
Page 32 GAO-23-105540 Electronic Health Information Exchange
In addition to the contact named above, Gerardine Brennan (Assistant
Director), Andrea E. Richardson (Analyst-in-Charge), Ying Hu, Cynthia
Khan, Christina C. Murphy, Vincent Patierno, Monica Perez-Nelson,
Chase Polak, and Roxanna T. Sun made key contributions to this report.
Diona Martyn and Eric Peterson also made contributions to this report.
Appendix II: GAO Contact and Staff
Acknowledgments
GAO Contact
Staff
Acknowledgments
Related GAO Products
Page 33 GAO-23-105540 Electronic Health Information Exchange
Public Health Emergencies: Data Management Challenges Impact
National Response. GAO-22-106175. Washington, D.C.: September
2022.
Electronic Health Records: VA Needs to Address Data Management
Challenges for New System. GAO-22-103718. Washington, D.C.:
February 1, 2022.
Prescription Drug Monitoring Programs: Views on Usefulness and
Challenges of Programs. GAO-21-22. Washington, D.C.: October 1,
2020.
Health Information Technology: Approaches and Challenges to
Electronically Matching Patients’ Records across Providers. GAO-19-197.
Washington, D.C.: January 15, 2019.
Health Information Technology: HHS Should Assess the Effectiveness of
Its Efforts to Enhance Patient Access to and Use of Electronic Health
Information. GAO-17-305. Washington, D.C.: March 14, 2017.
Electronic Health Records: Nonfederal Efforts to Help Achieve Health
Information Interoperability. GAO-15-817. Washington, D.C.: September
16, 2015.
Related GAO Products
The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
Contact FraudNet:
Website:
https://www.gao.gov/about/what-gao-does/fraudnet
Automated answering system: (800) 424-5454 or (202) 512-7700
A. Nicole Clowers, Managing Director, [email protected], (202) 512-4400, U.S.
Government Accountability Office, 441 G Street NW, Room 7125, Washington,
DC 20548
Chuck Young, Managing Director, young[email protected], (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Stephen J. Sanford, Managing Director, [email protected], (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548
GAO’s Mission
Obtaining Copies of
GAO Reports and
Testimony
Order by Phone
Connect with GAO
To Report Fraud,
Waste, and Abuse in
Federal Programs
Congressional
Relations
Public Affairs
Strategic Planning and
External Liaison
Please Print on Recycled Paper.
