HHS seeking solutions to address FISMA compliance for health exchange

Health and Human Services Department official calls FISMA a hurdle to patient data exchange

Health and Human Services Department officials are looking for information technology solutions that comply with a key federal cybersecurity law while also allowing for exchange of federal health data with private entities, a senior health data exchange official said today.

Currently, federal medical agencies that handle patient data must comply with the Federal Information Security Management Act. If they want to share that data, the recipients also may need to comply with FISMA, according to Vish Sankaran, program director of HHS’ Federal Health Architecture. Similar issues apply to compliance with the Health Insurance Portability and Accountability Act , he added.

Sankaran said federal agencies are looking for guidance and solutions to enable them to exchange patient data while also maintaining compliance with FISMA.

One possibility being considered is a legal mechanism that may involve the patient authorizing transfer of the data so that it is no longer federal data, he suggested. The department also is considering technical solutions, such as use of intermediaries, cloud computing or Software as a Service, which might allow for FISMA compliance with both sender and recipient.

The federal health architecture office, which is part of HHS’ Office of the National Coordinator for Health IT, has been working to develop health data exchange with 20 federal agencies on the Nationwide Health Information Network, currently a pilot project. The office also has developed free open-source software, known as Connect, enabling parties to connect to the NHIN.

Next year, the office will release the third update of Connect, which can be used, in conjunction with Electronic Health Records, to fulfill the meaningful use standards of the economic stimulus law, Sankaran said.

Currently, the Social Security Administration is demonstrating secure exchange on the NHIN, and Sankaran said his office is preparing to offer several contracts for NHIN technical support that will help move the NHIN to full production.

In December, the national coordinator’s office will begin distributing $564 million in grants for state-based Health Information Exchanges, which will eventually be linked with the NHIN as well.

In early 2010, the office will release Connect 3.0, which can be used, in conjunction with electronic health records, to fulfill the meaningful use standards of the economic stimulus law, Sankaran said. Under the law, HHS will distribute $19 billion to doctors and hospitals that purchase certified electronic record systems and demonstrate meaningful use of those systems.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.

Featured

  • FCW @ 30 GPS

    FCW @ 30

    Since 1986, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

  • Shutterstock image.

    Merged IT modernization bill punts on funding

    A House panel approved a new IT modernization bill that appears poised to pass, but key funding questions are left for appropriators.

  • General Frost

    Army wants cyber capability everywhere

    The Army's cyber director said cyber, electronic warfare and information operations must be integrated into warfighters' doctrine and training.

  • Rising Star 2013

    Meet the 2016 Rising Stars

    FCW honors 30 early-career leaders in federal IT.

Reader comments

Fri, Nov 13, 2009

Well, unfortunately, HHS is required to comply with FISMA for any and all of its information systems, so this is a valid challenge. FISMA in of itself isn't the problem - the problem is that you can create all the security frameworks you want for the government, but until they provide the funding to enable implementation, and enforce repercussions to those agencies that don't comply, nothing will work. FISMA in the hands of unqualified personnel results in a battle for "perceived compliance" rather than true security. Any other security framework would suffer the same fate.

Fri, Nov 13, 2009

FISMA? FISMA has nothing to do with the transfer of Health data, that is the sole realm of HIPPA. FISMA relates to the security of systems not the type of data being transfered. Also FISMA in and of itself is NOT a secure approach. As can be seen in several newsworthy examples, agencies can score very high on FISMA and not be secure. Compliance does not equate to Security - if it did, we would not have so many notable breeches.

Thu, Nov 12, 2009 Jeremy Engdahl-Johnson Seattle, WA

Federal funding may be encouraging a move toward EHR, but there's more to it than just installing systems. How can healthcare data pooling lead to a better system? More at http://www.healthcaretownhall.com/?p=1499

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group