Hearings to examine transforming health care with data, focusing on improving patient outcomes through next-generation care.
No chapters available yet
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Speaker 2
Perfect. Chairman Cassidy, ranking member Sanders, and distinguished members of this committee, thank you for the opportunity to provide testimony on the work that HHS is doing to improve outcomes for all Americans through the exchange, access, and use of health data. Before I joined government, I worked as an interventional radiologist. I practiced medicine in rural Ohio as well as in big cities like Chicago. I have experienced firsthand the persistent challenges and the incredible advancements that characterized the last twenty years of health information exchange.
I am glad to report to this committee that we have made tremendous progress during my tenure. I appreciate the work this committee has done over the years to make this possible. As the Assistant Secretary for Technology policy and national coordinator for health information technology, I lead nationwide efforts to advance health information technology and also lead efforts to expand electronic health information exchange. My top priority is data liquidity. My office is singularly focused on how technology can make health care more affordable and can enable a patient centered health system where medical records follow the patient.
Core to addressing affordability is our work to develop a trusted nationwide infrastructure for secure health data exchange. Since secretary Kennedy took office, we have implemented provisions of the twenty first Century Cures Act and grown the trusted exchange framework and common agreement. TEFCA, as it is known, is an interoperability network which allows nationwide health information exchange. TEFCA now connects more than 70,000 locations and has supported exchange for nearly 500,000,000 health records, up from 10,000,000 when Secretary Kennedy took office. TEFCA reinforces participants' existing obligations to comply with privacy and security rules, including HIPAA, and applicable state laws.
Technology alone, though, is not enough. Despite technological advancements and improved exchange infrastructure through Tefka, information does not always move the way it is supposed to the way that any patient or clinician would expect. One of the biggest obstacles to data liquidity is information blocking. We are a quarter of the way through the twenty first century, and information blocking is unacceptable. In September 2025, Secretary Kennedy announced a major enforcement initiative.
On February 11, I announced that my office is in the process of issuing notices of potential nonconformity to potential violators of the information blocking regulations. As this work continues, we are collaborating closely with the Office of Inspector General so that bad actors face meaningful consequences and so that patient data isn't hoarded in silos. For too long, healthcare has been too expensive with uneven access to high quality care. In July 2025, we published a final rule which gives doctors unprecedented, real time access to prescription drug information, allowing prescribers to identify the most appropriate, cost effective treatment for patients, while preventing health insurers from blocking physician approved care. Showing a doctor the drug cost at the time of prescribing results in hundreds of dollars of savings for common medications and thousands of dollars in savings for specialty medications.
For a senior on a fixed income, the ability of a prescriber to choose a covered low cost drug can mean the difference between skipping a prescription and being able to afford an essential medication. Nearly every hospital and ambulatory care provider uses health technology certified through the ONC Health IT Certification Program. In December 2025, we published a proposed rule to streamline outdated certification criteria, reduce regulatory burden, and re center the program on modern standards of interoperability. An open, interoperable health data ecosystem invites entrepreneurship, drives innovation, and cements American leadership and competitiveness in the expanding digital health marketplace. In conclusion, our efforts are aimed at a simple but ambitious goal: a health system where people can see, manage, and share their health information as easily as they manage their finances or travel itineraries.
In the not so distant future, an individual with multiple chronic conditions can keep all of their health information in one secure digital place and share it instantly with a new provider, a caregiver, or even a secure trusted app, no matter where they live or where they receive care. With continued support from Congress, ASTP will turn this person centered, data driven vision into an everyday reality for people and families across the country. I look forward to your questions.
Speaker 3
Thank you, doctor Cassidy, and welcome, doctor Keane. Appreciate a treat to see you again. The number one complaint I get from patients, especially patients on Medicare Advantage, is how their health care is delayed because of how Medicare Advantage is manipulating prior authorization. They're literally using it to delay their care. Prior authorization is the number one administrative concern of physicians as well.
I wanna say thanks for what you've done to help us so far on the technical aspect of getting our our bill to where it is right now. The improving seniors timely access to care act is on the just sitting there on the doorstep waiting to be passed by this congress. But maybe you could just give us a little update on on what you and the administration have done to go ahead in in this process and working on prior authorization?
Speaker 2
Yeah. Thank you for the, question, senator Marshall. As I spoke of in my opening statement, back in, July 2025, we finalized our HTI four final rule that undertook two provisions to make health care more affordable and to decrease administrative burden on both patients and providers. One of these provisions was to adopt standards to allow electronic prior authorization to occur in real time at the point of care so that adjudications of prior authorization could happen while the patient is in the doctor's office and that proper care could be selected. We promulgated a number of standards that allow electronic health records to communicate with insurance companies in real time and between the insurance companies and the doctor's office, the electronic prior authorization can happen.
Of course, promulgating the standards is only the first step. And we've been working very closely with our colleagues at CMS. As you know, CMS had a number of insurers undertake pledges to make sure that prior authorization adjudications occur in real time for approximately 80% of prior authorizations. I believe the pledge date is oneonetwenty seven. So we are working very closely with our colleagues at CMS to make sure that the standards not only exist, but that they're adopted in the market and actually implemented.
Speaker 3
What are the barriers that you see going forward to really bring this so patients don't have this challenge? What are the barriers, I guess?
Speaker 2
Thank you for the question. With the standards in place on both the payer and provider side, the barriers is getting them to talk. And that's a little bit like herding cats. But what we found is that both the insurers and the electronic health record companies are very committed to meeting the pledge. I don't think anybody wins from the prior authorization system as it currently exists.
It creates about $20,000,000,000 in provider burden over ten years, about $2,000,000,000 a year. And from what the insurers tell us, they approve the vast majority of prior authorizations and it is a very high administrative cost for them as well. Getting the insurers and getting the electronic health records to actually communicate through the standards so that they can find each other, so that they can talk to each other, so that the information that's reflected in the standards is actually accurate and up to date is the biggest challenge. But we found great partners in both the insurers and the electronic health record providers, and we will continue to work with them.
Speaker 3
You know, Doctor. Cassidy and I both went through this, going from pencil and a script pad to medical electronic medical records. And we could sit in our office and email the pharmacy of your choice, And it was one of the greatest things I ever saw. I'll talk about, you know, simplistic. But on on and why that worked is because the pharmacies were very motivated to make it work.
Do you feel like these big oligopolies that are insurance companies are are willing to cooperate? Are they wanting to cooperate? Or are they throwing up more and more barriers as you try to implement this?
Speaker 2
Well, that's thank you for the question. At least in our experience, they are identifying where the choke points are and are identifying solutions to those choke points. You talk about the pharmacy issues and how they were resolved a little bit by email. In the HTI-four rule, we also adopted standards for real time prescription benefit determination. This means increasingly at the point of care, doctors will not only be able to choose a therapeutically appropriate drug for a patient, Doctors will also be able to see what the alternatives the therapeutically appropriate alternatives are and what the costs of those alternatives are for that particular patient based on where the patient is in their insurance plan.
The ability to choose what is not only a therapeutically appropriate alternative but also a cost effective alternative for the patient is really a game changer. You'll have fewer instances of a doctor getting a call from the patient in the pharmacy parking lot saying, I couldn't afford my prescription. And that's going to improve adherence and improve outcomes for patients. So we've gone beyond the email and hopefully we will get to a point where you just press a button and the best alternative for a patient based on both efficacy and cost will be proffered.
Speaker 3
Well thank you, Chairman. I'll yield back and if we get a second round maybe I'll get a couple more.
Speaker 4
little intimidated to be the only person with a mic in front of my face who's not an MD today, but but I'll wade in as an educated layperson. Call me Tom. Alright, Tom. Thank you. I wanna ask you a sort of a technical question about the HITECH Act.
My understanding is that prior to its passage, very few hospitals had switched over to electronic health records. The passage of the bill and the incentives that came with it have been very successful According to the data that your agency provides, 96% of hospitals now use some kind of interoperable EHR. And that's largely attributable to the financial incentive. But the original legislation didn't cover all aspects of health care and social services. The HITECH Act limited the incentive payments to critical access and acute care hospitals, but excluded important providers like behavioral health providers, long term care facilities, and social service providers.
Fifteen years later, the funding that incentivized the uptake is no longer available. And I'm concerned that others won't move to the EHR. So if you could, doctor Keane, to start, talk to about talk to us about the rate of adoption interoperable EHR by providers and facilities that were not included in the HITECH Act.
Speaker 2
Thank you for the question, senator. When I started in this position, I asked the career staff who've been moving all of these initiatives forward for twenty years what was something that where we could really make an impact. And one of the first things surfaced was incorporating behavioral health providers into the health tech ecosystem and to the EHR system. So we have been laser focused on making sure that all providers in the market get the benefits of electronic health records and electronic health data exchange. I can tell you a number of the initiatives that we're undertaking to try to address this.
The first is our behavioral health information technology initiative, which is a $20,000,000 initiative that we're doing with the Substance Abuse and Mental Health Services Administration. We developed what's called The U. S. Core Data Set for Interoperability for Behavioral Health that allows for exchange of data between traditional medical providers, behavioral health providers, and even occupational health social service agencies and vocational service agencies I'm sorry, occupational providers and vocational service agencies as well as housing assistant agencies. We are currently running pilots in nine states including 45 exchange partners.
So for example, in one of the states, when a patient is discharged from having a behavioral health or substance use disorder crisis and they're going out into the community, we want to make sure their medical information as well as their social needs are properly communicated to social service agencies, vocational health agencies, and the like.
Speaker 2
Currently there are electronic health records that particularly target long term care facilities and that are specifically designed to allow data interchange with long term care facilities. Our hope with our HTI5 role is that by pivoting certification criteria from the older emphasis on workflow and baseline standards to a new focus on interoperability, that new solutions will enter the market that are affordable, innovative, and customized to providers such as long term care providers.
Speaker 4
I have one other topic I want to address, and that is it's very, very good to have these interoperable systems, but it is also important to that the data that's there be shared. During the public health emergency of COVID, d a HHS required hospitals and providers to report COVID cases to public health agencies. And the CDC also launched a portal for electronic case reporting. That ECR is now a quality measure for Medicare. We couldn't have mounted the effective response to COVID without the requirement of data sharing.
Some of those requirements went away when the public health emergency was ended. I have worked beginning with senator Isaacson, our friend, who was such a great leader on this committee on public health data sharing. And I think there's more to do. I have a bill called the improving data in public health act, which would direct CDC to establish standards for sharing public health data to protect, you know, confidential information, but to enable us to utilize the data to more effectively manage public health operations. What did we learn about the importance of electronic records and this sharing during the COVID nineteen pandemic?
Speaker 2
Thank you for the question, senator, and appreciate your focus on public health reporting. And I think you raise very serious issues, and we appreciate your support on these. We learned a great deal about both the opportunities and the barriers to public health reporting. At ONC, we have developed a US CDI plus for public health data reporting. This is our US core data set for interoperability that captures public health data elements so that they can be effectively reported to public health agencies, to the CDC, from the electronic health records.
The lack of data was one of the issues that we had in adequate COVID response, but the agency has really picked up the ball, both myself and my predecessors, to make sure that this information is captured by electronic health records and is interoperable and computable. We appreciate your focus.
Speaker 4
And and mister chair, as I as I yield back to you, Hickenlooper and I were talking before he exited for a sec. We're we're two of the 30 people in the history of The US that have been a mayor, governor, and US senator, which is a tribute not to our judgment, but to our survival skills. But one of the things we both see is, you know, when when a city health department has some data and then state or city or county, then state has some data, then federal agencies have data, then private providers have data. We know so there's so much knowledge out there and yet the sharing of it is often very siloed, which means that the knowledge that we have is not really maximized in terms of the public health benefit it it can attain. And I know those of you who are physicians completely get that.
So one of the good things about this hearing is I think it helps us, you know, think about ways to knock down some of the silos so that we can more effectively use the the knowledge that we already have, but it's just spread so wide that we don't often do it in an effective way. I'm glad you called this hearing today.
Bill Cassidy
I'm glad you're an attorney. Not really glad you're an attorney, but you are an attorney. So I'm glad you're here. So I'm gonna ask this first question in light of what you just said. I'll be interested in your perspective.
Doctor Keane, it seems as if the future promise of these records would include AI giving clinical support. I'm a I'm a practitioner in a rural area, and I automatically have all access to someone's record. And I get, keep in mind, they're taking this medicine. And if you give them this new medicine, there could be an interaction. But that suggests that I would have the ability to upload all of my information into platform and give AI access to it.
Are you with me?
Bill Cassidy
And it's a little bit of a variant of what senator Kane was just asking. How can we take this information, upload it, and allow it to be worked with by AI? Lots of implications here. Mhmm. Who's liable?
Who gets to use the data that flows from it that might be for financial gain? Mhmm. What are the privacy issues? Mhmm. Have you all thought about these issues?
Because ultimately, the promise of AI is that it's able to make us healthier, at least in health care, and using medical records. So you must have thought about that your thoughts, please.
Speaker 2
Yeah. Thank you for the question, chairman Cassidy. As you know, in December 2025 we put out a request for information on how AI can be safely and effectively deployed in the health care system so that it is aligned with current standards. We have so far received hundreds of responses and submissions that will help guide not only our policy in how AI can be deployed, but also the policies of our sister agencies. And we're happy to share that information with Congress as well so that we can deploy this effectively and responsibly.
As a radiologist, I can tell you I've been using AI for over twenty years. Of the 1,300 approved medical
Bill Cassidy
You're looking at an x-ray. I'm talking about me electing to put my data up to be managed.
Speaker 2
We provide patients consistent with HIPAA the ability to get access to their electronic health records. And within our TEFCA network, we have restrictions on what the individual access providers can do. So for example, they are not allowed to resell the data. They are not allowed to use the data for marketing. There are specific prohibitions against using the data in employment, credit, or insurance determinations.
However, once a patient gets control of their information, they have freedom to do with it what they want.
Bill Cassidy
So let me ask. Yeah. If there's clinical decision making support. Yeah. Okay, use this antihypertensive, not that blood pressure medicine.
Mhmm. Is that you? Do you regulate that or is FDA?
Speaker 2
I believe that's the purview of the FDA. What we regulate is the ability to get ahold of that information. And there's great promise. You probably know that one of my colleagues at CMS, her daughter has a chronic disease and a rare disease. And she took her daughter's medical records and uploaded them into an AI chatbot and the AI chatbot was able to do what the doctors she had been seeing could not.
Namely, they found a clinical trial for her daughter to enroll in. But that of course required her to release that information to the chatbot and she has the autonomy to do that. I know that Senator Marshall and you both practice medicine and one of my habits is to go online and see what patients say about the procedures that I do. Not necessarily that me as a physician have done, but the general category of procedures so I can see how to improve my approach to treating those patients. Of course, these patients are sharing their information freely.
Bill Cassidy
So let me ask you this. The part of the help that information sharing, in the twenty first Century Cures Act, we mandated that providers and EHR vendors use application programming interfaces to allow third party apps to access the information on behalf of the patient. There have been allegations that that is also a point of blocking, that the ability to create connectivity is either not being done or in some other way this provision is being abused. So thoughts about that? Is that real or not?
And how do we prevent both the blocking of the of the development of an API to be able to attach to download information for the benefit of the patient or if somebody can successfully do so that that information is abused?
Speaker 2
Yeah. Thank you for the question, senator. In our current engagement with the marketplace, we are finding different reports of how much this information is accessible. I recently was told by a one provider of AI augmented care to patients that they were able to pull approximately 90% of patient records. I've heard from others that they're able to pull far less.
We've received into our information blocking complaint portal over 1,500 allegations of information blocking. We've shared that with the Office of Inspector General and they are undertaking their process to investigate these complaints. We also, starting in February, have issued notice of potential nonconformity to potential information blockers to let them know that they may be in violation of the regulations. They will respond to us and if they're found to be information blocking, we will put them on a corrective action plan. If they're not compliant with the corrective action plan, we can pull their certification and they lose the opportunity to receive payment incentive
Speaker 2
We are we have actually pursued it. We've issued notices of nonconformity already.
Speaker 5
Thank you, mister chair. Thank you, doctor Keane, for being here and for your all your public service. I want to take a moment just to recognize senator Kane here, who I understand was blowing smoke at me. I do wanna reiterate that once you've been a mayor and then a governor of a state, you understand health care in a more granular way. And a lot of what your experience, what you've seen and learned and wanna put into effect, I think, are immediately sympathetic to the the needs for those improvements.
In your testimony, you discussed some of the information exchange barriers we're seeing between patients and caregivers, clinicians. Yeah. I mean, I agree. We think about these large employers, people with 10,000 or many thousands of employees that they provide health care for. They bid it out to these large corporations, the insurance, whether it's Cigna or UnitedHealthcare, whoever.
But once that contract is awarded, it goes opaque. They can't see anything. So they although they have a natural self interest to try and lower costs and and and find savings and efficiencies between hospitals or clinics or
Speaker 2
that protect patient privacy and safety, that prevent data breaches is central to our mission. And we were doing this before the reorganization and we're doing it after the reorganization. And we're doing everything we can to preserve patient privacy, security, and to make sure that all of the agencies are aligned around this. Now the specific agency that deals with cyber security breaches is the Assistant Secretary for Preparedness and Response and of course the FBI and the Cybersecurity and Infrastructure Security Agency. But we take these issues very seriously, as do you, and we appreciate your focus on them.
Speaker 6
Thank you. So, you know, I'm concerned that this administration is actually showing signs of kind of walking back from that progress, and from the will to align health agencies to best protect patients. So does the department still believe well, me move to another question. I want to ask you about some guardrails. You know, we're seeing AI embedded directly into clinical software systems used by doctors and nurses, meaning these technologies are increasingly influencing diagnoses, treatment decisions, and care management.
So what role do you believe ASTP should play in establishing guardrails that ensure these technologies are safe, transparent, and trustworthy for clinicians and patients?
Speaker 2
Thank you for the question, Senator. As I was mentioning to Chairman Cassidy, as a radiologist, I've been using AI for twenty years and it has transformed the field. As a physician and as somebody who's helped select AI systems for radiology practices, we are absolutely forensic in examining what the AI is capable of doing, making sure that it helps us in our job, and making sure that it's safe for patients. We believe that we have a very real role in making sure that patient safety and privacy are protected by the AI systems that we oversee. This is why in December we put out an RFI asking the broad public doctors, nurses, patients, EHR developers and AI developers what the best approach to regulating AI is and we intend to use the information we get from that RFI not only to inform our regulatory regime, but also to share with Congress and to share with our sister agencies at HHS.
Speaker 6
Thank you so much. Well, do you believe that the current authorities across HHS are sufficiently growing the use of AI in clinical settings? Or are these gaps in the federal framework that Congress should be paying attention to?
Speaker 2
Thank you for the question. I believe that our RFI will surface that. I can't really comment on the authorities of the other agencies. I believe within our agency we have sufficient authorities to certify health IT and to manage the nationwide network that we oversee to make sure that the AI that's deployed is safe and effective. I can tell you we collaborate very closely with our colleagues at CMS.
We collaborate closely with our colleagues at FDA and we help inform their thinking about how their regulation should be promulgated. But I would let those agencies speak about what they're doing.
Speaker 3
Senator Marshall. Right. Thank you, chairman. I'm enjoying this so much. I get a second round.
I do think it's it's important to point out that we do have two bills between our price tags bill and our prior authorization bill that would literally change the health care experience for Americans. And I appreciate this committee's commitment to giving us a hearing very soon, a markup, excuse me, a markup on our price tag bill, hopefully, we can figure a way to get prior authorization across the finish line as well. I wanna talk about interoperability for a second. Of of all the I think probably the biggest failure of EMR was was interoperability. When I purchased, made the decision on which one for our hospital, a physician owned hospital, they guaranteed me that, yes, it'll be able to talk to all the others.
But indeed, we had a had a Dodge, hospitals had a Ford, and there was Chevys, and they didn't talk to each other. So we formed committees. We prayed about it. We threw money at it. And, you know, when I left practice, they still weren't talking to each other.
And I'm still not convinced that they are. I'm frustrated that Department of Defense aren't all in the same EMR. VA as well, and I know they're trying to get there, but just huge hurdles, it sounds like to me. I can't believe that's not been accomplished. You would think that if you're gonna take money from the federal government Medicare that you it would be your responsibility to be able to communicate with with CMS.
And I think you you that's your goal. Right?
Speaker 3
So I guess what are what's keeping us from from doing that? And and I know you're making making progress. What are the challenges ahead of you? How are you dealing with people that with organizations that are blocking?
Speaker 2
Thank you for question, senator. And I see you've had the same experience as a physician that I have of hearing one thing from salespeople
Speaker 2
And finding another thing when you actually get their product. In order to make interoperability work, there have to be clear standards, which we are constantly refining and which we are working with standards organizations to continue to develop. There have to be tools for conformance with those standards. And we fund and actually operate our own conformance testing tools to make sure that, for example, when we promulgate a fire standard in our regulation, that that fire standard is actually conformed to by all of the people who sign their certification attestations. Additionally, we have to make sure that people are not willfully engaging in information blocking.
And that's why our efforts to enforce the information blocking regulations through issuing notices of potential nonconformance and through consultation with OIG can help prevent people who are willing
Speaker 3
to There's probably, what, three or four companies that control 80 or 90% of the EMRs out there. Are they is there is there one that's not being cooperative? Is there what what can we do to encourage them to to to help unlock their their codes?
Speaker 2
Yeah. We we don't pick winners and losers, and we work with the assumption at ASTP that everybody wants to be a good actor in the market. When we find that people are thought by their exchange partners to be information blocking, we inform them. We discuss with them what we think they're doing incorrectly and if it comes to it, then we issue a notice of nonconformity and we refer the case to the office of inspector general. Have any of those cases went forward?
I can't comment on what the office of inspector general is doing because I'm barred from knowing. They're an independent agency.
Speaker 3
Good good enough. But, you know, I I certainly do think there's bad actors out there. And you're too kind, and I appreciate that. But I I do think we need to start hold holding some of these companies accountable.
Speaker 2
Some of them have these notices of nonconformity landing on their desks, so we'll see how they react.
Speaker 3
Good. I think maybe the last thing I'll talk about is my goal was that we truly have you and I, that it's my record, it's my medical record, a personalized medical record that I control. And I I think, you know, you're we're we're making steps in that direction. But any any ideas on how do we make that into reality, where it truly is my medical record, and I don't have to call my doctor's office. I'm now in a sitting in an emergency room in Washington, DC, and I all I gotta do is say, here's my app, here's my medical record, and we'll email it to you, whatever we gotta do.
Speaker 2
Yeah. Thank you for the question and thank you for the concern with this issue. The TEFCA network that we've stood up and have continued to grow and during secretary's Kennedy's tenure, the number of documents exchanged have gone up by a factor of 50 has a particular exchange purpose called individual access services. And the idea is that consistent with the HIPAA rule, a patient is able to get that information in a form that they want, including on their phone, so that they are empowered by that information and so that they can share it with a caregiver, a provider, or an app. And the individual access services is being built out.
We're doing everything we can to address the challenges of sharing across different systems, networks, organizations, geographies, and we're making real progress. And with continued support from the senate and congress, we should be able to get it to the point where everybody is empowered by their health records.
Speaker 3
Can you be more specific? What what can we do to put wind beneath your cells? Is it just financial resources?
Speaker 2
What we're doing at ASTP is looking at increasing the number of demographic variables to allow more reliable patient matching. And we're also increasing the number of security controls so that people are more willing to share so that in the event that there is a suspected breach, the information doesn't get compromised. One of the challenges that people are uncomfortable sharing the information because they don't want there to be improper sharing. So thank you.
Speaker 7
Thank you, mister chairman. And and doctor, welcome. A lot of interest in your testimony this morning. I'm sorry what I haven't been here for for most of it. But my my team has been following with great interest in Alaska, as as you well know.
Got a lot of territory to cover. Populations are very spread out, small communities, and access to providers is limited. And so we have been one of those that have have pioneered a lot when it comes to to telehealth and figuring things out that way. Part of the challenge though is in many parts of the state, it's tough to make all that technology work because we just we're not connected like the rest of the country is. And so as you are working to push out these advancements, I would just ask that you keep in mind that those who stand to benefit most from digital health modernization may have the least capacity to do so.
And so how we're knitting this all together is where I'm really very interested. We're looking at the Rural Health Transformation Fund, seeing a lot of promise to that, but also recognizing that we got a lot to do to just get to par with what many people in America have come to expect and to be able to receive on these devices. In addition to our geography, we we are blessed to have more veterans per capita than any other state. And we are also very fortunate to be the home of two twenty nine federally recognized tribes, more than half the tribes in the country. And of course, both of these groups, the VA and the IHS, use government health systems.
We talk a lot about the interoperability of our systems. And in fact, when you ask people, how does this work? They kind of snort, and like, yeah. We talk a lot about it. But the seamless integration is not really there.
The question to you this morning is whether or not the multiple agencies have been engaged in this interoperability planning, the standards development that we're talking about, so that we've got broader alignment. Because what happens is if you're an Alaska native in a village, you're not gonna have access to IHS. And so the provider that sees you there is not a VA provider, it's an IHS provider. Likewise, a non native veteran in the village is seen in the IHS clinic. There's no boundaries there, which is great.
But when we talk about systems, are we going to inadvertently possibly be creating some barriers? Do you think about this?
Speaker 2
Thank you for the question, senator. Hopefully not. I I should mention this last Christmas, I got a a gift of salmon from the Wild Alaska Company, I think, and
Speaker 2
Yeah. It's fantastic stuff. Was it below the gift limit? Came from a family member.
Speaker 2
Yes. So I'd like to say that the Indian we have a good collaboration with the Indian Health Services. They are the first government organization to join TEFCA and we have worked very closely with them on their health IT modernization efforts. We meet with them, I believe monthly, and give routine consultations on workforce needs, staffing needs. We helped them pick their vendor as well as their contractor.
And we really are interested in maturing the interoperability between the Indian Health Service and other providers. It is getting better. And we'd be happy to work with your office to get more insights.
Speaker 7
Well, I would appreciate just kind of knowing how things are are advancing. And I I I I value what you're saying about early engagement with IHS. I think that's really important. I'm also the the chairman of the Senate Indian Affairs Committee. And we talk a lot about tribal data privacy and sovereignty, and a recognition that historically much of the data that comes from from our tribal communities has been collected and managed by federal agencies or outside entities without the the clear tribal governance that creates issues in and of itself.
And so making sure that you are incorporating that or factoring that into the process along the way, again, I think is gonna be very, very important for for what we can do to anticipate better health outcomes for for tribal members.
Speaker 2
Yeah. We we are very focused on the privacy and security protections in the TEFCA network, and I would love to work with your office to see how we can really mature the data exchange with the tribes and the Indian Health Service. As a former rural practitioner, I'm really focused on making sure that this works for everybody.
Speaker 7
Well, and and if I I might use this forum to invite further discussion with members of the Indian Affairs Committee on these issues of of of tribal health information and privacy concerns. I'd look forward to that. Mister chairman, thank you so much for for inviting doctor Keane to the hearing today.
Speaker 8
Thank you very much, Mr. Chairman. And thank you for giving me the opportunity to ask questions. Doctor. Keane, thank you for your testimony.
I'm sorry that I'm a bit late. Another committee hearing that is just going on and on. But it's great to be here with you. I want to talk to you, if I could, about cybersecurity at rural hospitals. In Missouri, 40% of our hospitals statewide are rural.
That's over 70 of our hospitals. We have seen multiple cyber attacks. In fact, the last three years, 60% by one reckoning of rural hospitals in the country faced a cyber attack. But that's a that's a very big number. There was a hospital near my state, Spring Valley, Illinois, Saint Margaret's Health, that was actually forced to close its doors after a ransomware attack in 2021.
So can you tell us a bit more about how cyber attacks on rural hospitals directly affect quality of care for the patients that they serve?
Speaker 2
Thank you for the question, Senator. There's no question that cybersecurity attacks on any hospital, but particularly the under resourced hospitals that typically serve rural populations, how this can be devastating. In the programs that we administer, we are laser focused on making sure that data is protected and that patients and that systems are secure. Our current HTI5 rule is giving providers of electronic health record technology the opportunity to pivot away from box checking cybersecurity requirements to be consistent with the risk based framework under the HIPAA security rule. As you know, the HIPAA security rule requires transmission security, audit controls, access controls, and the like.
And we want hospitals to be able to adopt the most advanced sort of security postures to prevent these cyber attacks in the future. We would like the certification program to move at the pace of cyber security to assure that these sorts of attacks are rare if if ever happen.
Speaker 8
Let me just ask you. In your own priorities, in terms of in your role as the assistant secretary, how does rural hospital cybersecurity factor? And and you said you'd you'd like to see the protocols be changed, be updated to move with the pace of the threat. I mean, tell us a little bit more about that. What are you doing to see that effectuated?
Speaker 2
Yes. Our HTI five rule is updating certification criteria so that it can adopt the most modern standards for cyber security. So for example, in our current program, we ask people to say whether they use multi factor authentication or not. And there are newer standards for cyber security that cannot be phished, something like the Fido two standard. And what we'd like to do is make sure that these newer standards can be adopted as they come out through our certification program.
As a rural provider myself, I I was in a situation for a cyber security attack happened at my hospital in Zanesville, Ohio that shut us down for a day and a half. So I've lived through it. And I understand how serious these are and I understand the problems with ransomware attacks. The attacks will always become more sophisticated, so we have to make sure that our our cybersecurity posture and certification program keep up, and the flexibilities that we're introducing to be consistent with the HIPAA security rule will allow that to happen.
Speaker 8
In June, senator Hassa and I introduced a bill called the Rural Hospital Cybersecurity Enhancement Act, which this committee has passed unanimously. It's awaiting action on the floor of the senate. What it does in part and relevant part is directs HHS to develop a comprehensive rural hospital cybersecurity workforce strategy, development strategy, that at a very minimum would consider public private partnerships, development of training resources, and policy recommendations. Can I just help you can I just ask you, would the development of a comprehensive workforce strategy like that help your office further its goals of improving quality of care and optimizing systems for rural health care providers?
Speaker 2
Thank you for the question, Senator, and thank you for the focus on cyber security and also rural health care providers. I did it for the entire first part of my career. Anything that the Senate can do to help us improve the cyber security posture of all hospitals, in particular rural and underserved hospitals, would be helpful to HHS. And we're happy to provide technical assistance on any legislation that you're considering.
Speaker 8
Good. Very good. Thank you. Well, I hope to see the bill pass the full Senate soon and look forward to working with you on that and I'm sure other matters. Mr.
Chairman, thank you again.
Bill Cassidy
Thank you, senator Hawley. I'll have a second round myself. First, I wanna point out, by the way, senator Hawley, the infrastructure investment jobs act is now dispensing money to make sure that everyone has access to high speed affordable Internet. So the rural patient in Missouri and in Louisiana will now have access to telehealth, telemental health, etcetera. So I do think that there is a a the operational operationalization of this is in the offing.
So just to say that. And then, doctor Keane, we spoke earlier about administrative burdens. And I'm told that ASTP ONC has recently proposed a rule to remove 34 certification criteria required for health IT products. Some changes are for criteria no longer in effect. Others include those related to privacy and security.
Now what I don't know with the removal of these, is it because they are merely a regulatory burden for people to bring in new products because sometimes regulations restrict market access? Or if the removal of these regulations mean that it will be less secure and fewer protections to privacy?
Speaker 2
Thank you for the question, chairman, and thank you for the opportunity to provide clarification. We believe that the pivot towards a more modern aligned certification program will allow for the most advanced cybersecurity posturing and the most advanced privacy protections to be introduced into the certification program. We did an assessment of all 60 certification criteria that we promulgate and we looked for ones that were outdated, that were redundant, that had become firm market baselines, or that were not widely adopted because people didn't certify to them. So for example No.
Bill Cassidy
Hang on. But not certifying does not necessarily mean it's not valid. Correct?
Speaker 2
That's correct. But if the uptake for a particular certification criteria is low, it's not having an impact on the market. And further, even if somebody certifies to the criteria, it doesn't mean that it's actually deployed. And I can give you a concrete example. I mean, you would practice medicine for over two decades.
And we have a criteria that asks EHR developers if they support multi factor authentication. We don't require them to do that, we just ask them if they do. And about half do and about half don't. Very few actually deploy these in actual hospital settings. And as you know, having practiced, the reason is it's very hard to do multi factor authentication in the actual physician workflow.
There are very strong privacy and security protections within the hospitals themselves. One of them is you have to badge into the physician's office. Increasingly, hospitals are taking FIDO2 secondurity postures which are even more advanced than multi factor authentication. All of the EHRs and all of the hospitals have to observe all the strictures of the HIPAA security rule, which require, you know, transmission security, integrity controls, audit controls, access controls. And I won't bore you with things like transport layer security 1.3.
But as these as these technologies evolve, we wanna make sure that the governing law, the HIPAA law, which is risk based, is the one that everybody adheres to so that the latest and greatest technologies
Bill Cassidy
Well, let me ask you this. Yeah. Go and stay on HIPAA. We talked about somebody uploading their personal health information to an AI platform that could then integrate their data. Under HIPAA, would that AI platform then be a covered entity with all of the protections to the patient's data that is implied by being a covered entity or not?
Speaker 2
Thank you for the question. So CMMI just recently released, I believe, their access model in which individual apps like the ones you're speaking of can actually enroll as Part B providers in Medicare to get some sort of compensation for using the app. And under those situations, those apps are covered entities and they're covered by HIPAA. But to the point that you're making, a large portion of the apps that people are uploading their data to are not covered entities and HIPAA doesn't apply to them.
Bill Cassidy
So that we need do we need can that be done by rule? Because you mentioned earlier the need to make sure that privacy is protected. 100% in agreement. And so there's not philosophically a difference between an app, which is required to be HIPAA compliant, and AI, which is being uploaded to and then can use my data. Mhmm.
And you said under tech Tekla or whatever, it's not supposed to be commercialized or used for marketing.
Bill Cassidy
But again, if you put it up here in the AI, then it could be by somebody who is willing to push the envelope.
Speaker 2
Patients have autonomy on how their data is used. I think it's important that the patient understands how that data is going be
Bill Cassidy
me stop you, though. My patient population, and I find most patients, are not aware of these issues. You and I live and breathe them. But unless you're an engineer who's anal compulsive, which by definition, you're an engineer, you know what I'm saying.
Bill Cassidy
Yeah, I'm redundant. Most people are not gonna understand the implications of putting my genetic data up there, which then AI could then figure out who all my relatives are and then could potentially redline my relatives for insurance because even though we have a law against it, somehow they could work around because they now have access to my genetic data. So I do think there's some some consumer safeguards that should be implemented, like a box that pops up. Your data uploaded will be boom, boom, boom, now accessible for marketing unless you say not. Do you agree or disagree?
Speaker 2
We agree at ASTP that anything that improves the security and privacy posture of patients is something worth looking at and something that we support. Yeah. I can tell you that we are laser focused on it in the programs that we administer. And But do you
Bill Cassidy
need new authorities for that, or does Congress have to pass a law? Or is it even philosophically not where you are? Because the previous ONC director seemed to feel pretty much like a libertarian. The patient could do whatever they wanted with the data. And I'm thinking, sure, they can, but I don't know if they know what they're doing with their data.
Speaker 2
Yeah. And as somebody who's practiced medicine for two decades, I understand that patients don't always understand where their data is going. And I believe that anything that improves the security and privacy posture of patients.
Bill Cassidy
But do you need more authority or can you do that with your current authority?
Speaker 2
I don't think that we are able to regulate data that the patients have consented to be released. What I can say is that the standards that we promulgate create a clean surface on which any future regulation or legislation can actually act effectively.
Bill Cassidy
Yeah. And by the way, let me emphasize. I'm a very much techno optimist when it comes to AI. But the old principle that bad money drives out good, we can force people to go to the lowest common denominator, the the bad actor forcing the action of all others.
Speaker 2
And we really hope that doesn't happen, and we appreciate your focus on it.
Bill Cassidy
For any senator wishing to ask additional questions, questions for the records are due 5PM, Thursday, March 19. Again, doctor Keane, thank you for being here.
Ask anything about this video — I analyse its transcript to answer.