The Department’s Office of the National Coordinator (ONC) provides leadership for the development and nationwide implementation of an interoperable health information technology (HIT) infrastructure. ONC is charged with guiding the nationwide implementation of interoperable HIT to reduce medical errors, improve quality, produce greater value for health care expenditures, ensure that patients’ individually identifiable health information is secure and protected, and facilitate the widespread adoption of electronic health records (EHR).

On May 16, 2011, the Health and Human Services Office of the Inspector General (OIG) released the Audit of Information Technology Security Included in Health Information Technology Standards.

The Executive Summary states that the : “ONC had application information technology (IT) security controls in the interoperability specifications, but there were no HIT standards that included general information IT security controls. General IT security controls are the structure, policies, and procedures that apply to an entity’s overall computer operations, ensure the proper operation of information systems, and create a secure environment for application systems and controls.”

At the time of the initial audit, the interoperability specifications were the ONC HIT standards and included security features necessary for securely passing data between EHR systems (e.g., encrypting transmissions between EHR systems). These controls in the EHR systems were application security controls, not general IT security controls.

The OIG recommendations are as follows:

  1. The ONC should broaden its focus from interoperability specifications to also include well-developed general IT security controls for supporting systems, networks, and infrastructures.
  2. The ONC should use its leadership role to provide guidance to the health industry on established general IT security standards and IT industry security best practices.
  3. The ONC should  emphasize to the medical community the importance of general IT security.
  4. The ONC should coordinate its work with the Centers for Medicare & Medicaid Services and the Department’s Office for Civil Rights to add general IT security controls where applicable.

In a response letter to OIG, the Office of the National Coordinator concurred with the recommendations. The ONC noted that its work on security is an evolving process and that it will work with its advisory committees to “actively explore” the feasibility of adding general IT security controls to EHR certification criteria, such as encryption of portable media and two-factor authentication.