HHS seeking solutions to address FISMA compliance for health exchange

Health and Human Services Department official calls FISMA a hurdle to patient data exchange

Health and Human Services Department officials are looking for information technology solutions that comply with a key federal cybersecurity law while also allowing for exchange of federal health data with private entities, a senior health data exchange official said today.

Currently, federal medical agencies that handle patient data must comply with the Federal Information Security Management Act. If they want to share that data, the recipients also may need to comply with FISMA, according to Vish Sankaran, program director of HHS’ Federal Health Architecture. Similar issues apply to compliance with the Health Insurance Portability and Accountability Act , he added.

Sankaran said federal agencies are looking for guidance and solutions to enable them to exchange patient data while also maintaining compliance with FISMA.

One possibility being considered is a legal mechanism that may involve the patient authorizing transfer of the data so that it is no longer federal data, he suggested. The department also is considering technical solutions, such as use of intermediaries, cloud computing or Software as a Service, which might allow for FISMA compliance with both sender and recipient.

The federal health architecture office, which is part of HHS’ Office of the National Coordinator for Health IT, has been working to develop health data exchange with 20 federal agencies on the Nationwide Health Information Network, currently a pilot project. The office also has developed free open-source software, known as Connect, enabling parties to connect to the NHIN.

Next year, the office will release the third update of Connect, which can be used, in conjunction with Electronic Health Records, to fulfill the meaningful use standards of the economic stimulus law, Sankaran said.

Currently, the Social Security Administration is demonstrating secure exchange on the NHIN, and Sankaran said his office is preparing to offer several contracts for NHIN technical support that will help move the NHIN to full production.

In December, the national coordinator’s office will begin distributing $564 million in grants for state-based Health Information Exchanges, which will eventually be linked with the NHIN as well.

In early 2010, the office will release Connect 3.0, which can be used, in conjunction with electronic health records, to fulfill the meaningful use standards of the economic stimulus law, Sankaran said. Under the law, HHS will distribute $19 billion to doctors and hospitals that purchase certified electronic record systems and demonstrate meaningful use of those systems.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.