The Senate Committee on Health, Education, Labor, and Pensions will please come to order. Increasingly, patient care happens outside the exam room. any of us can pull up our health records, make an appointment, refill a prescription on our phones, and that is a huge advantage
to patients and doctors, saying that as as as a person who is a doctor and who has been a patient. And so digital access to our health records allows doctors and hospitals to share a patient's information so quickly, and it's at least convenient and in some
circumstances life-saving. Whether you're out of town and need to go to the emergency room or maybe you want a second opinion or to see a specialist, having easy digital access to health information makes the process work better. In 2009,
Congress established the Office of the National Coordinator, ONC, to transition the health care system to a fully digital system. Today, we'll hear from ONC on their work to standardize health information sharing and put patients in the driver's seat. We've made a lot of
progress on this, but there is more to do. There continues to be the issue of information blocking, which I think our witness will speak to, where one party blocks another from sharing data even with the patients consent. Now
uh frankly um on that I'm looking forward to hear what you have to say because hospitals tell me that they are transferring back and forth and patients will tell me sometimes not the case and doctors will tell me sometimes not the case and so I don't know if it's something which is improving with the
relative balance of but I look forward to your uh kind of illuminating that. I'll note that the Biden administration did not respond to a single case of information blocking. So maybe that means there's absolutely none of it going on or maybe it just wasn't
enforced. Uh but again, I'm hearing different things. Now, I practice medicine for over 25 years. Ideally, you have all the information you can get to treat the patient well. Um and that's why I and others led efforts to outlaw information blocking in the 21st
century's cure act. and I thank the Trump administration for acting upon this. Dr. King, who's here today, is working with HHS Secretary Doc uh Robert Kennedy to investigate allegations of information blocking and taking appropriate action. Um u
we must also consider how Congress can continue to modernize patient access to information. ONC created the trusted exchange framework and common agreement or TEFLA to standardize health information sharing and to give the patient the power of access. Just last
month almost 500 million health records were exchanged through TEFA in a secure and protected manner. Improving ways to exchange information is propatient and delivers better care. So we must redouble efforts to make sure that bad actors don't use TEFLA for their own
goals. Now for all of us for from I as a physician patients are the priority. We're living in a digital age for that there are advantages and disadvantages. The this committee should expand those advantages and to limit the disadvantages. We with the goal of
putting the patient first. That's why I introduced the health information privacy reform act. The committee also last week passed on a bipartisan basis my healthc care cyber security and resiliency act to respond to continuing threats of cyber attacks. Protecting
patient information is bipartisan and essential to deliver modern care. I look forward to discussing how we can do that. Uh Senator Kaine, are you going to make a statement for >> Okay. Uh so with that, um I'll introduce our witness and we will hear the
testimony. We're joined today by Dr. Dr. Thomas King, a medical doctor, assistant secretary for technology policy, and the national coordinator for health information technology at the Department of Health and Human Services. He previously served in the first Trump
administration in a variety of roles, including at ONC and supporting COVID 19 provider relief efforts. Dr. Keane is a clinician and engineer by training, previously practicing as a radiologist as well as a software developer. He
received his MD from the Albany Medical College and his MBA from the University of Chicago Booth School of Business. Thank you for being with us, Dr. King. >> Uh, thank you, Chairman Cassidy, are you guys able to hear me? >> Uh, yeah, you got the red button on.
>> Perfect. Uh, Chairman Cassidy, Ranking Member Sanders, and distinguished members of this committee. Thank you for the opportunity to provide testimony on the work that HHS is doing to improve outcomes for all Americans through the exchange, access, and use of health
data. Before I joined government, I worked as an interventional radiologist. I practice medicine in rural Ohio as well as in big cities like Chicago. I have experienced firsthand the persistent challenges and the incredible advancements that characterize the last
20 years of health information exchange. I am glad to report to this committee that we have made tremendous progress during my tenure. I appreciate the work this committee has done over the years to make this possible. As the assistant secretary for technology policy and
national coordinator for health information technology, I lead nationwide efforts to advance health information technology and also lead efforts to expand electronic health information exchange. My top priority is data liquidity. My office is singularly
focused on how technology can make health care more affordable and can enable a patient centered health system where medical records follow the patient. Core to addressing affordability is our work to develop a trusted nationwide infrastructure for secure health data exchange. Since
Secretary Kennedy took office, we have implemented provisions of the 21st Century Cures Act and grown the trusted exchange framework and common agreement. TEFA, as it is known, is an interoperability network which allows nationwide health information exchange.
TEFA now connects more than 70,000 locations and has supported exchange for nearly 500 million health records, up from 10 million when Secretary Kennedy took office. TECA reinforces participants existing obligations to comply with privacy and security rules,
including HIPPA and applicable state laws. Technology alone though is not enough. Despite technological advancements and improved exchange infrastructure through TEFLA, information does not always move the way it is supposed to, the way that any patient or clinician would expect. One
of the biggest obstacles to data liquidity is information blocking. We are a quarter of the way through the 21st century and information blocking is unacceptable. In September 2025, Secretary Kennedy announced a major enforcement initiative. On February
11th, I announced that my office is in the process of issuing notices of potential nonconformity to potential violators of the information blocking regulations. As this work continues, we are collaborating closely with the Office of Inspector General so that bad
actors face meaningful consequences and so that patient data isn't hoarded in silos. For too long, healthc care has been too expensive with uneven access to highquality care. In July 2025, we published a final rule which gives
doctors unprecedented realtime access to prescription drug information, allowing prescribers to identify the most appropriate costeffective treatment for patients while preventing health insurers from blocking physician approved care. Showing a doctor the drug
cost at the time of prescribing results in hundreds of dollars of savings for common medications and thousands of dollars in savings for specialty medications. For a senior on a fixed income, the ability of a prescriber to choose a covered low-cost drug can mean the difference between skipping a
prescription and being able to afford an essential medication. Nearly every hospital and ambulatory care provider uses health technology certified through the ONC health IT certification program. In December 2025, we published a proposed rule to
streamline outdated certification criteria, reduce regulatory burden, and reenter the program on modern standards of interoperability. An open, interoperable health data ecosystem invites entrepreneurship, drives innovation, and cementss American
leadership and competitiveness in the expanding digital health marketplace. In conclusion, our efforts are aimed at a simple but ambitious goal. A health system where people can see, manage, and share their health information as easily
as they manage their finances or travel itineraries. In the notsodistant future, an individual with multiple chronic conditions can keep their all of their health information in one secure digital place and share it instantly with a new provider, a caregiver, or even a secure
trusted app. no matter where they live or where they receive care. With continued support from Congress, ASP will turn this person centered, datadriven vision into an everyday reality for people and families across the country. I look forward to your
questions. >> Thank you, sir. I will defer to Dr. Marshall. >> Thank you, Dr. Cassidy, and welcome, Dr. King. Appreciate it's great to see you again. The number one complaint I get from patients, especially patients on
Medicare Advantage, is how their health care is delayed because of how Medicare Advantage is manipulating prior authorization. They're literally using it to delay their care. >> Prior authorization is the number one administrative concern of physicians. a
as well. I want to say thanks for what you've done to help us so far uh on the technical aspect of getting our our bill uh to where it is right now. Um the improving seniors timely access to care act is on the just sitting there on the
doorstep waiting to be passed by this Congress. But maybe you could just give us a little update on what you and the administration have done to go ahead in in this process and working on prior authorization. Yeah, thank you for the uh question, Senator Marshall. Um, as I
spoke of in my opening statement, back in July 2025, we finalized our HTI4 final rule that undertook uh two provisions to make healthc care more affordable and to decrease administrative burden on both patients and providers. One of these provisions
was to adopt standards to allow electronic prior authorization to occur in real time at the point of care so that adjudications of prior authorization could happen while the patient is in the doctor's office and the proper care could be selected. Uh we
promulgated a number of standards uh that allow uh electronic health records to communicate with insurance companies in real time and between the insurance companies and the doctor's office. the electronic prior authorization can happen. Of course, promulgating the
standards is only the first step and we've been working very closely with our colleagues at CMS. As you know, uh CMS had a number of insurers undertake pledges to make sure that uh prior authorization adjudications occur in real time for approximately 80% of prior
authorizations. I believe the pledge date is 1127. So we are working very closely with our colleagues at CMS to make sure that the standards not only exist but that they're adopted in the market and actually implemented. >> What are the barriers that you see going
forward to to really bring this uh so patients don't have this challenge? What are the what are the barriers? I guess >> thank you for the question. um with the standards in place on both the uh payer and provider side, the barriers is
getting them to talk and uh that's a little bit like hurting cats. But what we found is that both the insurers and the electronic health record companies are uh very committed to meeting the pledge. I don't think anybody wins from the prior authorization uh system as it
currently exists. It creates about $20 billion in provider burden over 10 years, about $2 billion a year. And uh from what the insurers tell us, they approve the vast majority of prior authorizations and is a very high administrative cost for them as well.
getting the insurers and getting the electronic health records to actually communicate through the standards so that they can find each other so that they can talk to each other so that the information that's reflected in the uh standards is actually accurate and up-to-date is the biggest challenge. But
we found great partners in both the insurers and the electronic health record providers and we will continue to work with them. >> You know, Dr. Cassie and I both went through this going through going from pencil and a script pad to medical electronic medical records and we could
sit in our office and email uh the pharmacy of your choice and it was one of the greatest things I ever saw. Talk about you know simplistic but on and why that worked is because the pharmacies were very motivated to make it work. Do
you feel like these big olig oligopies of that are insurance companies uh are are willing to cooperate? Are they wanting to cooperate? Are they throwing up more and more barriers as you try to implement this? >> Well, that's thank you for the question.
Uh at least in our experience, uh they are identifying where the choke points are and are identifying solutions to those choke points. You talk about the uh pharmacy uh issues and how they were resolved a little bit by email. In the HTI4 rule, we also adopted standards for
real-time prescription benefit determination. This means increasingly at the point of care, doctors will not only uh be able to choose a therapeutically appropriate drug for a patient. uh doctors will also be able to see what the alternatives the therapeutically appropriate alternatives
are and what the cost of those alternatives are for that particular patient based on where the patient is in their insurance plan. Uh the ability to choose what is not only a therapeutically appropriate alternative but also uh a uh cost-effective
alternative for the patient is really a gamecher. you'll have fewer instances of a doctor getting a call from the patient in the pharmacy parking lot saying, "I couldn't afford my prescription." And that's going to improve adherence and improve outcomes for patients. So, we've gone beyond the email and uh hopefully
we will get to a point where you just press a button and uh the best alternative for a patient based on both efficacy and cost will be will be profered. >> Yeah. Well, thank you. Um Chairman, I'll yield back and if we get a second round, maybe I'll get a couple more. Good.
Senator Kaine, you >> I'm a little intimidated to be the only person with a mic in front of my face who's not an MD today, but but I'll weigh it in as an educated lay person. >> Call me Tom. >> All right, Tom. Thank you. Um, I want to ask you sort of a technical question
about the high-tech act. My understanding is that prior to its passage, very few hospitals had switched over to electronic health records. The passage of the bill and the incentives that came with it have been very successful. According to the data that
your agency provides, 96% of hospitals now use some kind of interoperable EHR and that's largely attributable to the financial incentive. But the original legislation didn't cover all aspects of health care and social services. The
high-tech act limited the incentive payments to critical access and acute care hospitals, but excluded important providers like behavioral health providers, long-term care facilities, and social service providers. 15 years later, the funding that incentivized the
uptake is no longer available, and I'm concerned that others won't move to the EHR. So, if you could, Dr. to start talk to about talk to us about the rate of adoption of interoperable EHR by providers and facilities that were not included in the high-tech act.
>> Uh thank you for the question, Senator. When I started in this position, I asked uh the career staff who've been moving uh all of these initiatives forward for 20 years. What was uh something that where we could really uh make an impact? And one of the first things surfaced was
incorporating behavioral health providers into the health tech ecosystem and into the EHR system. So we have been laser focused on making sure that all providers in the market uh get the benefits of electronic health records and electronic health data exchange. I
can tell you a number of the initiatives that we're undertaking to try to address this. The first is our behavioral health information technology initiative which is a $20 million initiative that we're doing with the substance abuse and mental health services administration. We developed what's called the US core
data set for interoperability for behavioral health that allows for exchange of uh data between traditional medical providers, behavioral health providers and even uh occupational health, social service agencies and vocational uh service agencies. uh I'm
sorry, occupational providers and vocational service agencies um as well as housing assistant agencies. Um we are currently running pilots in nine states uh including um 45 exchange partners. So, for example, in one of the states,
when a patient is discharged from having a behavioral health or substance use disorder crisis and they're going out into the community, we want to make sure that their medical information as well as their social needs are properly communicated to social service agencies, vocational health agencies, and the
like. >> How about long-term care facilities? Um, currently there are electronic health records that uh particularly target uh long-term care facilities and that are specifically designed to allow data interchange with long-term care
facilities. Our hope with our HTI5 role is that by pivoting our certification criteria from the older uh emphasis on uh workflow and baseline standards to a new uh focus on interoperability
that new solutions will enter the market that are affordable, innovative, and customized to providers such as long-term care providers. I have one other topic I want to address and that is it's very very good to have these interoperable systems but it is also
important to that the data that's there be shared um during the public health emergency of COVID uh DA HHS required hospitals and providers to report COVID cases to public health agencies and the CDC also launched a portal for
electronic case reporting that ECR is now a quality measure for Medicare we couldn't have mounted the effective response to COVID without the requirement of data sharing. Some of those requirements went away when the public health emergency was ended. I
have worked beginning with Senator Isacson, our friend who was such a great leader on this committee on public health data sharing. Um, and I think there's more to do. I have a bill called the improving data in public health act which would direct CDC to establish
standards for sharing public health data to protect um you know confidential information but to enable us to utilize the data to more effectively manage public health operations. What did we learn about the importance of electronic records and this sharing during the CO
19 pandemic? Uh thank you for the question, Senator, and appreciate your uh focus on public health reporting and uh I think you raise uh very serious issues and we appreciate your support on these. Um we learned a great deal about uh both the opportunities and the
barriers to public health reporting. At uh ONC, we have developed a uh USCDI plus for public health data reporting. This is our US core data set for interoperability that captures public health data elements so that they can be effectively reported to uh public health
agencies to the CDC uh from the electronic health records. Uh the lack of data was one of the issues that we had in adequate COVID response but the agency has really picked up the ball myself and my predecessors to make sure that this information is captured by
electronic health records and is interoperable and computable. and we appreciate your focus >> and and Mr. Chair, as I as I yield back to you, um Hickinlooper and I were talking before he exited for a sec, we're we're two of the 30 people in the history of the US that have been a
mayor, governor, and US senator, which is a tribute not to our judgment, but to our survival skills. But one of the things we both see is you know when when a city health department has some data and then state or city or county then state has some data and then federal agencies have data and then p private
providers have data. We know so there's so much knowledge out there and yet the sharing of it is often very siloed which means that the knowledge that we have is not really maximized in terms of the public health benefit it it can attain
and I know those of you who are physicians completely get that. So one of the good things about this hearing is I think it helps us you know think about ways to knock down some of the silos so that we can more effectively use the the knowledge that we already have. but it's
just spread so wide that we don't often do it in an effective way. I'm glad you called this hearing today. >> I'm glad you're an attorney. No, I'm not really glad you're an attorney, but you are an attorney. Uh so I'm glad you're here. Um so I'm going to ask this first question in light of what you just said.
I'll be interested in your perspective. Um Dr. Keane, it seems as if the future promise of these records would include AI giving clinical support. I'm a I'm a practitioner in a rural area and I
automatically have all access to someone's record and I get keep in mind they're taking this medicine and if you give them this new medicine there could be an interaction but that suggests that I would have the
ability to upload all of my information into a platform and give AI access to it. Are you with me? >> Yes. Um, and it's a little bit of a variant of what Senator Kaine was just asking. How can we take this information, upload it, and allow it to
be worked with by AI? Lots of implications here. >> Who's liable? Um, who gets to use the data that flows from it that might be for financial gain? >> Uh, what are the privacy issues? >> Have you all thought about these issues?
because ultimately the promise of AI is that it's able to make us healthier at least in healthcare >> and using medical records. So you must have thought about that. Your thoughts please. >> Yeah, thank you for the question uh Chairman Cassidy. Um as you know in
December 2025 we put out a request for information on how AI can be safely uh and effectively uh deployed in the health care system so that it is aligned with current standards. uh we have uh so far received hundreds of responses and
submissions that will help guide uh not only our policy and how AI can be deployed but also the uh policies of our sister agencies and we're happy to share that information with Congress as well so that we can deploy this effectively and responsibly. uh as a radiologist I
can tell you I've been using AI for over 20 years uh of the 1300 uh approved medical >> but that's different that's different than what I'm describing. >> Okay, >> you're looking at an X-ray. I'm talking about me electing to put my data up to be managed >> right
>> now. Would you have governance over this or would FDA? We uh provide patients consistent with HIPPA the ability to get access to their electronic health records and within our TEFLA network we have restrictions on what the individual access providers can
do. So for example they are not allowed to resell the data. Um they are not allowed to use the data for marketing. There are specific prohibitions against using the data in employment credit or insurance determinations. However, once a patient gets control of their
information, uh, they have freedom to do with it what they want. >> So, let me ask, yeah, >> if there's clinical decisionmaking support. >> Yeah. >> Okay. Use this anti-hypertensive, not that blood pressure medicine. >> Mhm. >> Is that you? Do you regulate that or is
FDA? >> I believe that's the purview of the FDA. What we regulate is the ability to get a hold of that information. And there's great promise. You probably know that. One of my colleagues at CMS, her daughter has a chronic disease and a uh rare disease. And she took her
daughter's medical records and uploaded them into uh an AI chatbot. And the AI chatbot was able to do what the doctors she had been seeing could not. Namely, they found a clinical trial for her daughter to uh enroll in. But that of
course required her to release that information to the uh the chatbot, and she has the autonomy to do that. I know that uh Senator Marshall and you both practice medicine and one of my um uh habits is to go online and uh see what
patients say about the procedures that I do. Not necessarily that me as a physician have done but the general category of procedures so I can see how to improve my approach to treating those patients. Of course these patients are sharing their information freely. So let
me ask you this. The um part of the help that information sharing in the 21st century cures act we mandated that providers and ehr vendors use application programming interfaces to allow third-party apps to access the information on behalf of the patient.
Mhm. >> There have been allegations that that that that is also a point of blocking that the uh um um ability to create connectivity is either not being done or some other way this provision is being abused. So
thoughts about that is that real or not? And how do we prevent both the blocking of the of the development of an API to be able to attach to download information for the benefit of the patient or if somebody can successfully do so that that information is abused? >> Yeah, thank you for the question,
Senator. Um, in our current engagement with the marketplace, we are finding different reports of how much this information is accessible. I recently was told by a uh one uh provider of AI augmented care to patients that they
were able to pull approximately 90% of patient records. I've heard from others that they're able to pull far less. We've received into our information blocking complaint portal over 1500 uh allegations of information blocking. We've shared that with the office of inspector general and they are
undertaking their process to investigate these complaints. We also starting in February have issued notices of potential nonconformity to potential information blockers to let them know that they may be in violation of the regulations. They will respond to us and
if they're found to be information blocking, we will put them on a uh corrective action plan. If they're not compliant with the corrective action plan, we can pull their certification and they lose the opportunity to receive payment incentives. >> And so you're actively pursuing it. >> We are. We have actually pursued it.
We've issued notices of nonconformity already. >> Thank you, Mr. Chair. Thank you, Dr. Keane, um, for being here and for all your public service. Uh, I want to take a moment just to recognize uh, Senator Kaine here, who I understand was, uh,
uh, blowing smoke at me. Um, I do want to uh reiterate that once you've been a mayor and then a governor of a state, you understand healthcare in a more granular way and a lot of what your experience, what you've seen and learned
and want to put into uh effect. I think we are immediately sympathetic to the needs for those improvements. In your testimony, you discuss some of the information um exchange barriers that we're seeing between patients and caregivers, clinicians. Yeah. >> Um
>> I mean, I agree. Uh we think about these large employers, people with 10,000 or many thousands of employees that they provide health care for. They bid it out to these large corporations, the insurance, whether it's Sigma or United
Healthcare, whoever. But once that contract is awarded, it goes opaque. They can't see anything. So they although they have a a natural self-interest to try and lower costs and and and find savings and efficiencies between hospitals or clinics or or
pharmaceutical companies, they're not they can't see the numbers. Um and I think that we have a major challenge with that lack of visibility and transparency with respect to prices. I think it makes it increasingly different difficult for the companies and and for patients just individual citizens to
understand what they're paying for healthcare. Um, so we've been proud to introduce the bipartisan patients deserve price tags uh patients deserve price tags act um with Senator Marshall uh who's done a commendable great job on
that and it does something really novel but really something that shouldn't be novel requires the publication of real prices for health care procedures uh from patients but also for employers whose real visibility and therefore competition will allow for the best prices possible. So you've discussed the
benefit of of real transparency and and what that can do about costs and uh you know increasing uh medication adherence. Do you worry that the current level of opacity I'm not sure if that's a real word um but the the the the clouding
over the the the hiding of our of costs in our healthcare system does not currently allow us to benefit from the necessary competition the natural inclination of competition to lower prices. Yeah, Senator Hickinlooper, I share your concern and we appreciate the
Senate's focus on this. Uh, I should say I had the opportunity to practice uh medicine in the Banner Hospitals just north of Denver. Gley, Lovelin, Fort Collins, and uh almost moved to Denver, so didn't quite work out, but I I enjoyed my time. >> You told me privately they had a
miserable mayor. >> He's still young. We might get him yet. You watch. Uh thank you for calling me young. You just made my day. Um yes uh obviously patients are empowered by price information and to the extent that we can provide that price information at
the point of care and allow for shared decision-making between the physician and the patient about what the most appropriate pharmarmacothotherapy is. We will continue to do that. Um we are actually working with direct to consumer pricing um
information providers to try to get not only the information from the pharmacy benefit managers but also the direct consumer pricing into the electronic health records because as you know often times the amount a patient will pay in a co-pay will actually exceed what they could purchase the drug for at a cash
price. And so we believe that the more information the patient has, the better off they are and the better adherence is. And we appreciate your focus and Congress's focus on this issue. It's the one area of the economy where pricing is opaque. And we hope to change that. >> Right. And it's a huge by most measures
uh even the American Medical Association, it's a four five approaching five trillion dollar spend every year. And when you think that 25% of that could be lack of efficiency or redundancy or in some cases fraud,
that's a lot of money to capture. I mean, you're talking about over somewhere in the trillion dollars a year >> uh category, if that's accurate. >> That's correct. The administrative burden related to health care is enormous. And there's no reason that this can't be automated even using
existing technology. The first step is getting the data captured and the second step is getting it exchanged by standards. Once that happens, things like prior authorization, price discovery, uh, and other administrative functions, even scheduling and appointments can be done in an automated
fashion. >> Well, I think you'll be great at implementing this bill once we get it passed. Um, I am out of time. Uh, the bud the Republican budget reconciliation bill, uh, makes severe funding cuts to rural hospitals. I think that's widely recognized. as a bunch of us are trying to figure out how to rectify that. But I
will submit in writing some questions around how do we make sure that we get the rural the funding to rural hospitals so they don't we don't see have closures of hospitals and clinics in rural areas one of the >> key backbones of our country. >> Thank you Senator Hickin Looper. was a uh rural practitioner myself for a
number of years in towns like Galapelis, Ohio and I understand the unique challenges that rural providers uh and patients face and it's my hope that during my tenure we can leverage information technology to sort of close those gaps and we'll be happy to provide
whatever technical assistance you need on the legislation. >> We'll make sure we stay in close touch. Thank you. I yield back. >> Thank you Senator Higalooper. Now, Senator also Brooks. >> Thank you so much, uh, Mr. Chair. You
know, digital tools and data systems are rapidly transforming health care in America. And when these technologies work well, they can help improve both the patient and provider experience. But when data systems fail, the consequences can be serious. Delayed care, privacy
risks, and clinicians spending more time navigating technology than caring for their patients. That means the policies governing these technologies should prioritize patient safety, clinical trust, and the integrity of our health care system. So, as Congress considers
the future of health data and next generation care, we need to ask a basic question. Are we strengthening the guard rails that protect patients or weakening them? Innovation without accountability does not build trust. And in healthcare,
trust is everything. So, Dr. King, you served with Mickey Trapathy, uh, the former assistant secretary former boss technology. Yes. And in 2024, HHS elevated the office of the national coordinator, created the ASTP, and
expanded its authority to include technology, data, and AI policy and strategy for the department. This was a timely rep prioritization following the February change healthc care data breach which compromised the personal data of
nearly 200 million Americans. The prior administration intended to move beyond a narrow focus on technical standards and better clarify the responsibility of disperate agencies for investing in technology, implementing it, and establishing regulations and payment
policies. All to help better align our federal response and preparedness for emergency threats. The idea that as health care becomes more digital and datadriven, HHS would need a forward-looking office capable of shaping the policy framework for those
technologies across the department. So would you share please why it was important to create a centralized system within the department to better coordinate policy efforts across operating divisions? Uh thank you for the question uh senator. The office of
national coordinator ONC has the coordinator as the main portion of its role and our uh ability to convene and work with our partners across HHS to promulgate standards uh that protect patient privacy and safety that prevent
data breaches is central to our mission. And we were doing this uh before the reorganization and we're doing it after the reorganization. and uh we're doing everything we can to preserve patient privacy security and to make sure that all of the agencies are
aligned around this. Now, the specific agency that deals with cyber security breaches is the assistant secretary for preparedness and response and of course the FBI and the cyber security and infrastructure security agency. But we take these issues very seriously as do
you and we appreciate your focus on them. >> Thank you. So, you know, I'm concerned that this administration is actually showing signs of kind of walking back uh from that progress and from, you know, the will to align health agencies uh to best pack patients. So, uh to best
protect patients. So, does the department still believe um you know, well, let me let me move to another question. I want to ask you about some some guard rails. Um, you know, we're seeing AI embedded directly into clinical software systems used by doctors and nurses, meaning these
technologies are increasingly influencing diagnosis, uh, treatment decisions and care management. So, what role do you believe ASP uh should play in establishing guard rails uh that ensure these technologies are safe, transparent, and trustworthy uh for
clinicians and patients? >> Uh, thank you for the question, Senator. As as I was mentioning to Chairman Cassidy, as a radiologist, I've been using AI for 20 years and it has transformed the field. Um, as a physician and as somebody who's helped select AI systems for radiology
practices, we are absolutely forensic in uh examining what the AI is capable of doing, making sure that it helps us in our job and making sure that it's safe for patients. We believe that we have a very real role in making sure that patient safety and privacy are protected
by the AI systems that uh we oversee. This is why in December we put out an RFI asking the broad public doctors, nurses, patients, EHR developers and AI developers what the best approach to regulating AI is. And we intend to use
the information we get from that RFI not only to inform our regulatory uh regime but also to share with Congress and to share with uh our sister agencies at HHS. >> Thank you so much. Well, do you believe um that the current authorities across
HHS are sufficiently growing the use of a AI in clinical settings um or are these gaps in the federal framework uh that Congress should be paying attention to? >> Thank you for the question. Uh I believe that our RFI will surface that. I can't really comment on the authorities of uh
the other agencies. I believe within our agency we have sufficient authorities to certify health IT and to manage the nationwide network that we oversee to make sure that the AI that's deployed is safe and effective. Um I can tell you we collaborate very closely with our
colleagues at CMS. We uh collaborate closely with our colleagues at FDA and we help inform their thinking about how their regulation should be promulgated. But I would let those agencies speak about what they're doing. >> Okay. Thank you so much. I yield. >> Senator Marshall.
>> Right. Thank you, Chairman. I'm enjoying this so much I get a second round. I do think it's it's uh important to point out that we do have two bills between our price tags bill and our prior authorization bill that would literally change uh the healthc care
experience for Americans and appreciate this committee's commitment to giving us a hearing very soon a markup, excuse me, a markup on our price tag bill and hopefully we can figure a way to get prior authorization across the finish line as well. I want to talk about interoperability for a second. Of of all
the I think probably the biggest failure of EMR was was interoperability. When I purchased made the decision on which one for our hospital, a physicianowned hospital to they guaranteed me that yes, it'll be able to talk to all the others. But indeed, we had a had a Dodge and the
other hospitals had a Ford and there was Chevys and they didn't talk to each other. So, we formed committees. We prayed about it. We threw money at it. And you know, when I left practice, they still weren't talking to each other. And I'm still not convinced that they are.
Um I'm frustrated that um Department of Defense aren't all in the same EMR. VA as well. And I know they're trying to get there, but just huge hurdles it sounds like to me. I can't believe that's not been accomplished. You would think that if you're going to take money from the federal government, Medicare,
that you it would be your responsibility to be able to communicate with with CMS. And I think that's your goal, right? >> Yes. So, I guess what are what's keeping us from from doing that? And I know you're making making progress. What are the
challenges ahead of you? How are you dealing with people that with organizations that are blocking? >> Uh, thank you. Uh, >> broad. Sorry. >> Fine. Thank you for the question, Senator. And, uh, I see you've had the same experience as a physician that I have of hearing one thing from salespeople. Yeah.
>> And, uh, finding another thing when you actually get their product. Um, in order to make interoperability work, there have to be clear standards which we are constantly refining and which we are working with standards organizations to uh continue to develop. There have to be
tools for conformance with those standards. And we fund and actually operate our own conformance testing tools to make sure that for example when we uh promulgate a fire standard in our regulation um that that fire standard is actually conformed to by all of the
people who sign their uh certification attestations. Additionally, we have to make sure that people are not willfully engaging in information blocking. And that's why our uh efforts to uh enforce the information blocking regulations through issuing notices of potential
non-conformance and through consultation with OIG can help uh prevent people who are will there's probably what three or four companies that control 80 or 90% of the EMRs out there. Are they is there is there one that's not being cooperative? Is there what can we do to encourage
them to to to help unlock their their codes? >> Yeah, we we don't pick winners and losers and we work with the assumption at ASP that everybody wants to be a good actor in the market. When we find uh that people uh are thought by their
exchange partners to be information blocking, we inform them. We discuss with them what we think they're doing incorrectly. And if it comes to it, then we issue a notice of nonconformity and we refer the case to the office of inspector general. Uh we
>> have any of those cases went forward? >> Uh I can't comment on what the office of inspector general is doing because I'm uh barred from knowing they're an independent agency. >> Good. Good enough. But you know, I certainly do think there's bad actors out there and you're too kind and I
appreciate that. But I I do think we need to start holding some of these companies accountable. Um, >> some of them have these notices of nonconformity landing on their desks. So, we'll see how they react. >> Good. I think the maybe the last thing I'll talk about is my my goal was that
that we truly have you and I we that it's my record. It's my medical record, a personalized medical record that I control. And I I think you know, you we're we're making steps in that direction. But any any ideas on how do
we make that into re reality where it's truly is my medical record and I don't have to call my doctor's office. I'm now in a sitting in an emergency room in Washington DC and I all I got to do is say here's my app. Here's my medical record and we'll email it to you
whatever we got to do. >> Yeah, thank you for the question. Uh and thank you for the concern with this issue. uh the TEFA network that we've stood up and have continued to grow and during Secretary's Kennedy's tenure uh the number of documents exchange have
gone up by a factor of 50 has a particular exchange purpose called individual access services and the idea is that consistent with the HIPPA rule a patient is able to get that information in a form that they want including on their phone so that they are empowered
by that information and so that they can share it with a caregiver a provider or or an app and the individual access services is being built out. We're doing everything we can to address the challenges of sharing across distance uh across different systems, networks,
organizations, geographies, and we're making real progress and uh with continued support from the Senate and Congress, we should be able to get it to the point where everybody is empowered by their health records. >> Can you be more specific? What what can we do to put wind beneath your cells? Is it just financial resources?
Um what we're doing at ASTP is uh looking at increasing the number of demographic variables to allow uh more reliable patient matching and we're also uh increasing the number of security controls so that people are more willing
to share so that in the event that there is a suspected breach the information doesn't get compromised. One of the challenges that people are uncomfortable sharing the information because they don't want there to be improper sharing. So, >> thank you.
>> Thank you, Dr. Marshall. And now, Senator Makowski. >> Thank you, Mr. Chairman, and and Dr. uh welcome. Um a lot of interest in your testimony this morning. I'm sorry I haven't been here for for most of it. Um but my my team has been following with great interest in Alaska, as as you well
know. Got a lot of territory to cover. Um uh populations are very spread out. Uh small communities and access to providers is limited. And so we have been one of those that have have pioneered uh a lot when it comes to toa health and figuring things out that way.
Uh part of the challenge though is in many parts of the state it's tough to make all that technology work because we just we're not connected like the rest of the country is. And so as you are working to push out these adv
advancements, I I would just ask that you you you keep in mind that those who stand to benefit most from from digital health modernization uh may have the least capacity to do so. And so how we're knitting this all together is where I'm
really very interested. We're looking at the health transform a rural health transformation fund seeing a lot of promise to that but also recognizing that we got a lot to do to just get to par with what many people in America have come to expect and to be able to
receive on these devices. Um in addition to our geography we we are blessed to have more veterans per capita than any other state. Um and we are also um uh very fortunate to be the home of 229
federally recognized tribes uh h more than half the tribes in the country. And of course both of these groups the VA and the IHS uh use government uh health systems. Um, we talk a lot about the interoperability
of our systems and in fact when you ask people how does this work they kind of snort and like yeah we talk a lot about it but the seamless integration is not really there. Um the question to you this morning is is whether or not um the
multiple agencies have been engaged in this interoperability planning uh the standards development that we're talking about so that we've got broader alignment because what happens is if you're an Alaska native in uh in a
village you're you're not going to have access to IHS and so the the the the the provider that sees you there is not a VA provider. It's it's an IHS provider. Um likewise, a non-native veteran in the
village. Um it is seen in in the IHS clinic. It there's no boundaries there, which is great. But when we talk about systems, are we going to inadvertently possibly be creating some barriers? Do you think about this?
>> Uh thank you for the question, Senator. Um hopefully not. I I should mention uh this uh last Christmas I got a gift of salmon from the Wild Alaska company I think and it >> it's fantastic stuff. Uh
>> was it below the gift limit >> came from a family member. >> That's exactly right. >> I think it's kosher >> given with love. >> Yes. So um I'd like to say that the uh Indian we have a good collaboration with the Indian Health Services. They are the
first uh government organization to join TEFA and we have worked very closely with them on their health IT modernization efforts. We've uh meet with them I believe monthly and give routine consultations on uh workforce
needs, staffing needs. We helped uh help them pick their um vendor as well as their uh contractor and we really uh are interested in maturing the interoperability between the Indian Health Service and other providers. It
is getting better and uh we'd be happy to work with your office to get more insights. Well, I I I would appreciate just kind of knowing uh how things are are advancing and I I I I value what you're saying about um early engagement with IHS. I think that's really
important. I'm also the uh the chairman of the uh Senate Indian Affairs Committee and we talk a lot about tribal data privacy and sovereignty and a recognition that historically much of the data that comes from from our tribal
communities has been collected and managed by federal agencies or outside entities without the the clear uh tribal governance that creates issues in and of itself. And so making sure that you are um uh in incorporating that or factoring
that into the process along the way again I think is going to be very very important for for what we can do to um anticipate better health outcomes for for tribal members. Yeah, we we are uh very focused on the privacy and security
protections in the TFKA network and I would love to work with your office to see how we can really mature the data exchange with the tribes and the Indian health service. Uh as a former rural practitioner, I'm really focused on making sure that this works for everybody. Well, and and if I I might
use this forum to invite further discussion um uh with members of the Indian Affairs Committee on these issues of of uh of of of tribal uh uh health information and privacy concerns. Um I'd
look forward to that. Mr. Chairman, thank you so much for for inviting Dr. Key to the hearing today. >> Thank you, Senator Marowski. And now, Senator Holly. >> Thank you very much, Mr. chairman and thank you for giving me the opportunity to ask questions. Uh Dr. Keane, thank
you for your testimony. I'm sorry that I'm a bit late. Another committee hearing that is just going on and on, but it's great to be here with you. I want to talk to you if I could about cyber security at rural hospitals in Missouri. 40% of our hospitals statewide are rural. That's over 70 of our
hospitals. We have seen multiple cyber attacks. In fact, over the last three years, 60% by one reckoning of rural hospitals in the country faced a cyber attack. But that's a that's a very big number. There was a hospital near my state, Spring Valley, Illinois, St. Margaret's Health, that was actually
forced to close its doors after a ransomware attack in 2021. So, can you tell us a bit more about how cyber attacks on rural hospitals directly affect quality of care for the patients that they serve? >> Uh, thank you for the question, Senator. There's no question that uh cyber
security attacks on any hospital, but particularly the underresourced hospitals that uh typically serve rural populations, how this can be devastating. Um in the programs that we administer, we are laser focused on making sure that data is protected and
that patients uh and that systems are uh secure. Uh our current HTI5 rule is uh giving providers of electronic health record technology the opportunity to pivot away from boxchecking cyber
security um requirements to be consistent with the riskbased framework under the HIPPA security rule. As you know the HIPPA security rule uh requires transmission security, audit controls, access controls and the like. And we
want hospitals to be able to adopt the most advanced sort of security postures to prevent these cyber attacks in the future. We would like the certification program to move at the pace of cyber security to asssure that these sorts of
attacks are rare if if uh ever happen. Let me just ask you in your own uh priorities in terms of um in your role as the assistant secretary, how does rural hospital cyber security factor and
and you said you you'd like to see the protocols be changed, be updated to move with the pace of the threat? I mean, tell us a little bit more about that. What are you doing to see that effectuated? Yes, our HTI5 rule is um updating the the certification criteria
so that it can adopt the most modern standards for cyber security. So for example uh in our current program we ask people to say whether they use multifactor authentication or not and um there are newer standards for cyber security that cannot be fished something
like the 502 standard and what we'd like to do is make sure that these newer standards can be adopted as they come out through our certification program. Um, as a rural provider myself, I I was in a situation for a cyber security attack happened at my hospital in
Zanesville, Ohio that shut us down for a day and a half. So, I've lived through it and I understand how serious these are and I understand the problems with ransomware attacks. Uh, the attacks will always become more sophisticated. So, we have to make sure that our um our cyber
security posture and certification program keep up and the flexibilities that we're introducing to be consistent with the HIPPA security rule will allow that to happen. >> In June of this past year, Senator Hassan and I introduced a bill called the Rural Hospital Cyber Security Enhancement Act, which this committee
has passed unanimously. It's awaiting action on the floor of the Senate. What it does in part in relevant part is directs HHS to develop a comprehensive rural hospital cyber security workforce strategy development strategy that at a very minimum would consider public private partnerships, development of
training resources and policy recommendations. Can I just help you? Can I just ask you with the development of a comprehensive workforce strategy like that help your office further its goals of improving quality of care and optimizing systems for for rural
healthcare providers? Thank you for the question, Senator, and thank you for the focus on cyber security and also rural healthc care providers. I did it for the uh entire first part of my career. Anything that the Senate can do to help us improve the cyber security posture of all hospitals, in particular rural and
underserved hospitals would be helpful to HHS and we're happy to provide uh technical assistance on any legislation that you're considering. >> Good. Very good. Thank you. Well, I hope to see the bill pass the full Senate soon and look forward to working with you on that and I'm sure other matters.
Mr. Chairman, thank you again. >> Thank you, Senator Holly. I'll have a second round myself. Uh, first I want to point out, by the way, Senator Holly, the U infrastructure investment and jobs act is now dispensing money to make sure that everyone has access to highspeed
affordable internet. So the rural patient in Missouri and in Louisiana will now have access to teleaalth, telemental health etc. So I do think that there is the operational oper operationalization
of this is in the offing. So just to say that um and then Dr. Keen. Um, we spoke earlier about administrative burdens and I'm told that ASPC has recently proposed a rule to remove
34 certification criteria required for health IT products. Uh, some changes are for criteria no longer in effect. Others uh include those related to privacy and security. Now what I don't know with the
removal of these is it because they are merely a regulatory burden for people to bring in new products because sometimes regulations restrict market access or um
if the removal of these regulations mean that it will be less secure and fewer u protections to privacy. Thank you for the question, chairman. Um, and thank you for the opportunity to
provide clarification. We believe that the pivot towards a more modern aligned certification program will allow for the most advanced cyber security posturing and the most advanced privacy protections uh to be introduced into the certification program. We did an
assessment of all 60 certification criteria that we promulgate and we looked for ones that were outdated that were redundant that had become firm market baselines or that were not widely adopted because people didn't certify to them. So for example, >> no hang on but not certifying does not
necessarily mean it's not valid. Correct. >> Uh that's correct. But if the uptake for um a particular certification criteria is low, it's not having an impact on the market. And further, even if somebody certifies to the criteria, it doesn't
mean that it's actually deployed. And I can give you a concrete example. I mean, you would practice medicine for over two decades. And um we have a criteria that asks EHR developers if they support multifactor authentication. We don't
require them to do that. We just ask them if they do and about half do and about half don't. Very few actually deploy these in actual hospital settings and as you know having practiced the reason is it's very hard to do multifactor authentication in the actual
physician workflow. There are very strong privacy and security protections within the hospitals themselves. One of them is you have to badge into the physician's office. uh increasingly hospitals are taking uh phto2 security postures which are even more advanced
than multifactor authentication. All of the EHRs and all of the hospitals have to observe all of the structures of the HIPPA security rule which require uh you know transmission security integrity controls uh audit controls access
controls and I won't uh bore you with things like transport layer security 1.3 but as these as these um technologies evolve we want to make sure that the governing law the HIPPA law which is riskbased is the one that everybody adheres to so that the latest and
greatest technologies. >> So, it isn't that we're relaxing, but rather that we're modernizing. >> Absolutely not. The HIPPA law uh still uh >> Well, let me ask you this. Yeah. >> Go and stay on HIPPA. >> We talked about somebody uploading their personal health information to an AI
platform that could then integrate their data. Um, under HIPPA, would that AI platform then be a covered entity with all of the protections to the patients data that is implied by being a covered entity or not?
>> Uh, thank you for the question. So CMMI just recently released, I believe, their access model in which individual apps like the ones you're speaking of can actually enroll as Part B providers in Medicare to get some sort of compensation for using the app. And
under those situations, those apps are covered entities and they're covered by HIPPA. But to the point that you're making, a large portion of the apps that people are uploading their data to are not covered entities and HIPPA doesn't apply to them. So, do we need do we need
um um can that be done by rule? Because you mentioned earlier the need to make sure that privacy is protected >> 100% in agreement. >> Uh and so there's not philosophically a
difference between an app which is required to be HIPPA compliant and AI which is being uploaded to and then can use my data. and you said under tech te tech or whatever it's not supposed to be commercialized or used for marketing
>> correct >> but again if you put it up here and the AI then it could be by somebody who is willing to push the envelope >> patients have autonomy on how their data is used I think it's important that the patient understands how that data is
going to >> let me stop you though >> my patient population uh and I find most patients um don't are not aware of these issues. You and I live and breathe them. >> Yeah.
>> But unless you're an engineer who's anal compulsive, which by definition, you're an engineer. You know what I'm saying? >> Trying to say. >> Uh yeah, I'm redundant. Um, most people are not going to understand the implications of putting my genetic data up there, which then AI could then
figure out who all my relatives are and then could potentially redline my relatives for insurance because even though we have a law against it, somehow they could work around because they now have access to my genetic data. So I do think there's some some consumer
safeguards that should be implemented like a box that pops up. Your data uploaded will be boom boom boom now accessible for marketing unless you say not. Do do you agree or disagree? >> We we agree at ASTP that anything that
improves the security and privacy posture of patients is something worth looking at and something that we support. Um, yeah, I can tell you that we are laser focused on it in the programs that we administer and >> but but do you need new authorities for
that or does Congress have to pass a law and or is it even philosophically not where you are? Because the previous ONC directors seem to feel pretty much like a libertarian. The patient could do whatever they wanted with the data. And I'm thinking sure they can, but I don't know if they know what they're doing with their data.
>> Yeah. And as as somebody who's practiced medicine for two decades, I understand that patients don't always understand where their data is going. And I believe that anything that improves the security and privacy posture of uh >> But do you need more authority or can you do that with your current authority?
>> Um I don't think that we are able to regulate uh data that the patients have consented to be released. What I can say is that the standards that we promulgate create a clean surface on which any future regulation or legislation can actually act effectively.
>> Yeah. And by the way, let me emphasize I'm a very much techno optimist when it comes to AI. But you know the old principle that bad money drives out good. Um we can force people to go to the lowest common denominator, the bad actor forcing the action of all others.
>> And we really hope that doesn't happen and we appreciate your focus on it. Um, for any senator wishing to ask additional questions, questions for the records are due 5:00 p.m. Thursday, March 19th. Again, Dr. King, thank you for being here.
>> Thank you so much, Chairman Cassidy. >> Thank you.