▶ 0:17:04Chair Cassidy: The senate committee on and pensions will please come to order. Increasingly patient care happens outside of the exam room. Any of us can pull up our health records, refill a prescription on our phones, and that is a huge advantage to patients and doctors, saying that as a person who has been a doctor and patient. Digital access allows doctors and hospitals to share patient information so quickly.
▶ 0:17:33Chair Cassidy: And it is at least convenient in -- and in some circumstances, life saving. Whether you are out of town or maybe you want a second opinion or to see a specialist, having easy, digital access to health information makes the process better. In 2000 nine, congress established the office of the national coordinator to transition the health care system to a fully digital system.
▶ 0:18:01Chair Cassidy: Today we will hear on their work to standardize health information sharing and put patients in the driver's seat. We have made a lot of progress but there is more to do. There continues to be the information -- the issue of information blocking where one party blocks another from sharing data even with the patient consent.
▶ 0:18:28Chair Cassidy: And frankly I am looking to hear what you have to say because hospitals say that they transfer back and forth in patients tell me tell me that is not the case and doctors will say not the case. I do not know if something that is improving the relative balance, but I look forward to your kind of illuminating it. I will know that the biden administration did not respond to a single case of information blocking, so maybe that means none of it is going on or maybe it was not even enforced.
▶ 0:18:59Chair Cassidy: But I am different things. I practice medicine for over 25 years, and ideally you have all the information to treat the patient well, and that is why I and others lead efforts to outlaw information blocking, and I thank trump administration for acting on this. He is working with secretary kennedy to investigate allegations of information blocking and taking appropriate action.
▶ 0:19:33Chair Cassidy: We must also consider how congress can continue to modernize patient access to information. Onc created a trusted exchange network and common agreement to standardize health information sharing and to give the patient the power of access. Just last month, over 500 million health records were exchanged in a secure and protected manner, improving ways to share -- to exchange information.
▶ 0:20:02Chair Cassidy: We must redouble efforts to make sure that bad actors do not use it for their own goals. Now, for all of us, from I as a physician, patients are the priorities. We are living in a digital age and there are advantages and disadvantages and this committee should expand those advantages and limit the disadvantages with the goal of putting the patient first.
▶ 0:20:25Chair Cassidy: That is why I the health information privacy reform act that the committee passed on a bipartisan basis my health care and cybersecurity and resiliency act to respond to continuing threats of cyber attacks, protecting patient information is bipartisan and essential to modern care. I look forward to discussing how we can do that. Senator, are you going to make a statement? Ok. So, with that, I will introduce our witness and hear the testimony.
▶ 0:20:56Chair Cassidy: We are joint -- joined by Dr. thomas keane, the assistant secretary for technology policy and the national court nadir for health information at the department of health and human services. He previously served in a variety of roles including at onc and supporting covid-19 provider relief efforts. He is a clinician and engineer by training and previously practicing as a radiologist and software developer.
▶ 0:21:25Chair Cassidy: He received his m d from the albany medical college and an mba from the university of chicago booth school of business, thank you for being with us.
▶ 0:21:33Dr. Keane: Thank you, chairman. Are you able to hear me?
▶ 0:21:37Chair Cassidy: Did you hit the red button?
▶ 0:21:40Dr. Keane: Perfect. Chairman cassidy, ranking member sanders and members of the committee, thank you for providing -- for allowing me to provide testimony on the work that hhs is doing to improve outcomes for americans on the exchange, access and use of health data. Before I joined government I worked as an interventional radiologist and practiced medicine in rural ohio and big cities like chicago.
▶ 0:22:09Dr. Keane: I have experienced firsthand the persistent challenges and incredible advancements that characterize the last 20 years of health information exchange. I am glad to report to the committee that we have made tremendous progress during my tenure. I appreciate the work the committee has done to make this possible.
▶ 0:22:28Dr. Keane: As the assistant secretary for technology policy and national coordinator for health technology, I advance health information technology and also lead efforts to expand electronic health information exchange. My top priority is data liquidity. My office is focused on how technology can make health care more affordable and enable a patient centered health center -- system where medical records follow the patient.
▶ 0:22:58Dr. Keane: Addressing affordability is part of making a nationwide infrastructure for secure health data exchange. At six secretary kennedy took office we have implemented provisions of the 20th century cares act and grown the exchange framework in common agreement. It isn't an interoperability network that allows nationwide health information exchange.
▶ 0:23:20Dr. Keane: It connects more than 70,000 locations and has supported exchange for a 500 billion health records, up for a 10 million when secretary kennedy took office. It reinforces existing obligations to comply with privacy and security rules including hepa and applicable state laws. Technology alone is not enough.
▶ 0:23:44Dr. Keane: Despite advancements and improved exchange infrastructure, information does not always move the way it is supposed to, the way that any patient or clinician would expect. One of the biggest obstacles is information blocking. We are a quarter of the way through the 21st century and information blocking is unacceptable. In september 2025, secretary kennedy announced an enforcement initiative.
▶ 0:24:10Dr. Keane: On february 11, I announce that my office is in the process of issuing notices a potential nonconformity to potential violators of the information blocking regulations. As this continues we collaborate closely with the office of inspector general so that bad actors face meaningful complement -- consequences and patient data is not in silos. For too long health care has been expensive with uneven access to quality care.
▶ 0:24:38Dr. Keane: In july of 2025 we published a final rule which gives doctors unprecedented and real-time access for prescription drug information, allowing subscribers to identify the most effective and cost -- the most cost-effective treatment for patients while stopping health insurers from blocking approved care. Showing the results and hundreds of thousands of dollars in savings for medications and thousands of dollars in savings for specialty medications.
▶ 0:25:07Dr. Keane: For a senior bank on a fixed income, being able to choose a low-cost drug means skipping a print -- the difference between skipping a prescription and affording essential medication. Nearly every hospital in in between ambulatory care provider uses the health certification program.
▶ 0:25:28Dr. Keane: In december 2025, we decided to streamline criteria and reduce burden and center it on the modern standards of interoperability. An open health data ecosystem invites entrepreneurship, drives innovation and cements of american leadership and competitiveness in the expanding digital health marketplace.
▶ 0:25:53Dr. Keane: In conclusion, our efforts are aimed at a simple but ambitious goal, a health system where people can see, manage, and share their health information as easy as -- as easily as they manage their health finances. In the not so distant future, an individual with chronic conditions can keep all of their health information in a secure digital place and share it instantly with a new provider, caregiver or even a secured and trusted app. No matter where they live or receive care.
▶ 0:26:24Dr. Keane: With continued support from congress, a stp will turn this into an everyday reality for people and families across the country. I look forward to your questions.
▶ 0:26:35Chair Cassidy: Thank you. I will defer to Dr. marshall.
▶ 0:26:42Sen. Marshall: It is great to see you again. The number one complaint that I get from patients, especially on medicare advantage is how their health care is delayed because of how medicare advantage is manipulating prior authorization. They are using it to delay their care. Prior authorization is the number one administrative concern of physicians as well.
▶ 0:27:11Sen. Marshall: I want to say thank you for what you have done to help us so far on the technical aspect of getting our bill to where it is right now. Improving the timely access to care act is on the doorstep waiting to be passed by this congress. That maybe you can give us a little update on what you and the administration have done to go ahead in this process and work on prior authorization.
▶ 0:27:37Dr. Keane: Thank you for the question. As I spoke in my opening statement, back in july of 2025, you finalize the hti4 final rule which made health care more affordable and decrease administrative burden on both patients and providers.
▶ 0:28:00Dr. Keane: One was to adopt standards to allow electronic prior authorization to occur in real time at the point of care, though that adjudication of prior authorization could happen while the patient is in the doctor's office and proper care could be selected.
▶ 0:28:16Dr. Keane: We promulgated a number of standards that allow electronic health records to communicate with insurance companies in real time, and between the insurance companies the doctor's office the electronic prior authorization can happen. Of course this is only the first step, and we have worked closely with our colleagues at cms.
▶ 0:28:40Dr. Keane: Cms had another avenged -- a number of insurers take pledges to make sure that prior authorization adjudications occur in real-time for approximately 80% of prior authorizations. So, we are working closely with our colleagues at cms to make sure that the standards not only exist, but they are adapted in the market and implemented.
▶ 0:29:01Sen. Marshall: What are the barriers you see going forward to really bring this so that patients do not have this challenge. What are the barriers, I guess?
▶ 0:29:12Dr. Keane: With the standards in place in both the payer and provider side, the barrier is getting them to talk. That is a bit like herding cats. We found the insurers and the electronic health record companies are committed to meeting the pledge. I do not think anybody wins from the prior authorization system as it currently exists. It creates $20 billion and provider burden.
▶ 0:29:44Dr. Keane: And what the insurers tell us, they approve the vast majority of prior authorizations and it is a high administrative cost for them. Getting insurers and the electronic health records to communicate through the standard to find each other so that they can talk to each other, so that the information reflected in the standards is actually accurate and up-to-date is the biggest challenge. We found great partners in the insurers and electronic health record providers and will continue to work with them.
▶ 0:30:13Sen. Marshall: We both went through this going from pencil and script pad to electronic medical records and we would sit in our office and female the pharmacy of your choice and it -- email the pharmacy of your choice. Talk about simplistic. Why it worked was that the pharmacies were motivated to make it work.
▶ 0:30:38Sen. Marshall: Do you feel like these big insurance companies are willing to cooperate, are they wanting to cooperate or are they throwing more barriers as I try to implement this?
▶ 0:30:52Dr. Keane: At least in our experience, they are identifying where the chokepoints are and identifying solutions. You talk about the pharmacy issues and how they were resolved a little bit by email. In the hti4 rule we adopted standards for real-time prescription benefit determination.
▶ 0:31:19Dr. Keane: That means increasingly doctors will not only be able to choose a therapeutically appropriate drug but they will also be able to see what the therapeutically appropriate alternatives are and what the costs are for that particular patient, based on where the patient is in their insurance plan. The ability to choose what is not only a therapeutically appropriate alternative, but also a cost-effective alternative for the patient is a game changer.
▶ 0:31:49Dr. Keane: You will have fewer instances of a doctor getting a call from the patient in the pharmacy parking lot saying I could not afford my prescription and that will improve outcomes for patients. We have gone beyond the email and hopefully we get to a point where you can press a button, and the best alternative for a patient based on efficacy and cost will be proffered.
▶ 0:32:10Sen. Marshall: Thank you and I will yield back. And if we get a second round I have a couple of more.
▶ 0:32:17Sen. Kaine: I am a little intimidated with the only person being met -- with a microphone in front of my face who is not an md.
▶ 0:32:26Dr. Keane: Call me tom.
▶ 0:32:29Sen. Kaine: I want to ask you a technical question. My understanding is that prior to its passage very few hospitals had switched over to electronic health records. The passage of the bill and its incentives have been very successful, according to the data that your agency provides, 96% of hospitals use some interoperable phr, and that is largely contributed bolt of the financial incentive.
▶ 0:32:59Sen. Kaine: The original legislation did not cover all aspects of health care and social services. The high-tech act limited the incentive payments for acute care, but excluded important providers like behavioral health providers and long-term care facilities and social service providers. 15 years later the funding is no longer available, and I am concerned that others will not move to the hr.
▶ 0:33:24Sen. Kaine: If you could to start, talk to us about the rate of adoption of interoperable hr by providers and facilities not included in the high-tech act.
▶ 0:33:35Dr. Keane: When I started in this position, I asked the career staff moving these initiatives forward for 20 years what was something where we could really make an impact, and one of the first things that was surfaced was incorporating behavioral health providers into the ehr system. We have been laser focused on making sure that all providers on the market get the benefits of electronic health records and data exchange.
▶ 0:34:05Dr. Keane: I can tell you a number of the initiatives that we are undertaking to address this. The first is behavioral health information technology initiative, a $20 million initiative that we are doing with substance abuse and mental health services.
▶ 0:34:26Dr. Keane: We allow for the exchange of data between traditional medical providers, behavioral health providers and even occupational health social service agencies and vocational service agencies. I am sorry, occupational providers. As well as housing assistance agencies. We are currently running pilots in nine states, including 45 exchange programs.
▶ 0:34:54Dr. Keane: In one of the states, and a patient is discharged from having a behavioral health or substance abuse disorder crisis and they are going out to the community, we want to make sure that their medical information and social needs are communicated to social service needs.
▶ 0:35:11Sen. Kaine: How about long-term care facilities?
▶ 0:35:14Dr. Keane: Currently there are electronic health records that particularly target long-term care facilities and are specifically designed to allow data interchange.
▶ 0:35:28Dr. Keane: Our hope with our hti5 rule by prohibiting our certification criteria from the older emphasis on workflow and baseline standards to a new focus on interoperability, that new solutions will enter the market that are affordable, innovative, and customized to providers.
▶ 0:35:49Sen. Kaine: I have one other topic I want to address, so it is good to have these interoperable systems. It is also important that the data be there chair -- data there is shared. During the public health emergency of covid, hhs required hospitals and providers to report covid cases to public health agencies and the cdc launched a portal for electronic case reporting and that is now a quality measure for medicare.
▶ 0:36:19Sen. Kaine: We could not have had an effective response to covid without the requirement of data sharing. Some of those went away when the public health was ended. I have worked beginning with senator isaacson, our friend who was such a great leader on this committee and public health data sharing, and I think there is more to do.
▶ 0:36:40Sen. Kaine: I have a bill called the improving data and public health act which will direct the cdc to establish standards for sharing public health data to protect pot -- confidential information and for us to utilize the data to manage public health operations. What did we learn about the importance of electronic records and sharing during the covid-19 pandemic?
▶ 0:37:01Dr. Keane: I appreciate your focus on public health reporting, and I think you raise a serious issue. We appreciate your support on these. We learned a great deal about healthy opportunities and the barriers to public health reporting at --.
▶ 0:37:22Dr. Keane: At onc we have developed data reporting, are set for interoperability, that captures public health elements they can be effectively reported to public health agencies like the cdc from the electronic health records. The lack of data was one of the issues we had in an adequate covid response. The agency has picked up the ball, myself and my predecessors to make sure this information is captured by electronic health records.
▶ 0:37:54Dr. Keane: We appreciate your focus.
▶ 0:37:54Sen. Kaine: Mr. chair, as I yield back, hickenlooper and I were talking before he exited, we are the two of the 30 people in the history of the U.S. who have been a mayor, governor and U.S. senator which is a tribute to our survival skills.
▶ 0:38:13Sen. Kaine: One of the things we both see is that when a city health department had some data and in the state, city or county has some data in the federal agencies have data in the private providers have data, we know that there is so much knowledge, and the sharing of it is also at -- often siloed, meaning that the knowledge that we have is not maximized in terms of health benefiting. And I know those of you who are physicians completely get that.
▶ 0:38:44Sen. Kaine: One of the good things is that I think it helps us think about ways to knock down some of the silos of that we can effectively use the knowledge we already have that has spread so wide that we do not often do it in an effective way.
▶ 0:38:59Chair Cassidy: I am not glad you are an attorney, but you are. I am glad you are here. I am going to ask this first question in light of what you just said and I will be interested in your perspective. It seems as if the future promise of these records would include ai giving clinical support.
▶ 0:39:23Chair Cassidy: I am a practitioner in a rural area and I automatically have all access to someone's record, and I get, keep in mind they are taking this medicine and if you give them this new medicine there could be an interaction. But that suggests that that I would have the ability to upload all of my information into a platform and give ai access to that. Are you with me?
▶ 0:39:49Dr. Keane: Yes.
▶ 0:39:50Sen. Kaine: Is --
▶ 0:39:52Chair Cassidy: It is a variant of what senator kaine was asking. How can we have this uploaded to ai? Lots of implications. Who is liable? Who gets to use the data that flows from it? What are the privacy issues? Have you thought about these issues? Because a promise of ai is that it is able to make it healthier -- us healthier. You must've thought about that.
▶ 0:40:23Chair Cassidy: Your thoughts.
▶ 0:40:24Dr. Keane: Thank you for the question. As you know, on december 2025 we put out a request for information on how ai can be safely and effectively deployed in the health care system so that it is aligned with current standards.
▶ 0:40:44Dr. Keane: We have so far received hundreds of responses and submissions that will help guide not only our policy and how ai can be deployed, but the policies of our sister agencies, and we are happy to share that information so we can deploy this effectively and responsibly. As a radiologist, I have been using ai for over 20 years. Of the 1300 approved.
▶ 0:41:09Chair Cassidy: That is different from what I am describing. You are looking at an x-ray and I am talking about me electing to put my data up to be managed. Would you have governance over this or what the fda?
▶ 0:41:22Dr. Keane: We provide patients consistent split -- consistent with hip u hippa electronic health records. And we have restrictions on what individual access providers can do. They are not allowed to resell the data. They are not allowed to use the data for marketing. There are specific prohibitions against using the data and employment, credit and insurance determinations.
▶ 0:41:52Dr. Keane: Once the patient gets control of their information, they have freedom to do what they want.
▶ 0:41:57Chair Cassidy: If there is clinical decision-making support, use this anti-hypertension and not that blood pressure medicine. Is that you, and do you regulate that or is that the fda?
▶ 0:42:12Dr. Keane: I believe that is the fda. We regulate the ability to get a hold of that information. You probably know that one of my colleagues at cms, her daughter has a chronic disease, a rare disease. She told her daughter's medical records and uploaded them into an ai chatbot. The ai chatbot was able to do with the doctor -- with the doctor she had been seeing could not, they found a clinical trial for her daughter to enroll in.
▶ 0:42:43Dr. Keane: That required her to release that information to the chatbot. And she has the autonomy to do that. I know that senator marshall and you practice medicine. One of my habits is to go online and see what patients say about the procedures that I do. Not necessarily that I have done, but the general category so I can see how to approve my choate -- my approach to treating these patients. They are sharing their information freely.
▶ 0:43:12Chair Cassidy: Let me ask you this. Part of the help of the information sharing in the 21st century cares act, we mandated that providers and vendors use application programming interfaces to allow third-party apps to access information on behalf of the patient. There have been allegations that that is our -- that that is also a point of blocking.
▶ 0:43:36Chair Cassidy: That the ability to create connectivity is either not being done, or in some other way this provision is being abused. So, thoughts about that, is that real or not and how do we prevent the blocking of the development of an api to attach to download information for the benefit of the patient, or if somebody cannot do so, that that information is not abuse.
▶ 0:44:01Dr. Keane: Thank you for the question. In our current engagement with the marketplace, we are finding different reports of how much of this information is accessible. I was recently told by one provider of ai augmented care that they were able to pull 90% of patient records. I have heard from others that they are able to pull last.
▶ 0:44:27Dr. Keane: We have received blocking complaints for over 15 hundred allegations of information blocking. We have shared that with the office of inspector general and they are undertaking their process to investigate. We also starting in february have issued notice of nonconformity to potential information blockers to let them know that they might be in violation of regulations. They will respond to us, and if they are found to be blocking, we will put them on a corrective action plan.
▶ 0:44:58Dr. Keane: If they are not compliance, we can pull their certification and they lose the opportunity to receive payment incentives.
▶ 0:45:05Chair Cassidy: You are actually -- actively pursuing them?
▶ 0:45:09Dr. Keane: We are actively pursuing them. We have issued notices of nonconformity.
▶ 0:45:17Sen. Hickenlooper: Thank you for being here and all of your public service and I would like to recognize senator kaine who I understand was blowing smoke at me. I do want to reiterate that once you have been a mayor and then a governor of a state, you understand health care in a more granular way than a lot of what you have experienced and learned and what to put into effect.
▶ 0:45:48Sen. Hickenlooper: We are immediately sympathetic to the needs for those improvements. In your testimony, you discussed some of the information exchange barriers we are seeing between patients and caregivers. I agree. You with -- you think about these large employers, many thousands employees that they provide health care for. They bid it out to large corporations, whether it is cigna or united health care.
▶ 0:46:19Sen. Hickenlooper: But once that contract is awarded it goes opaque and they cannot see anything. Although they have a natural self-interest to try and lower costs and find savings and efficiencies between hospitals and clinics or pharmaceutical companies, they cannot see the numbers.
▶ 0:46:37Sen. Hickenlooper: And I think that we have a major challenge with that lack of visibility and transparency with respect to prices and that makes it increasingly difficult for the companies and patients, individual citizens to understand what they are paying for health care. We have been proud to introduce the patients deserve price tags act with senator marshall, who has done a commendable job on that.
▶ 0:47:05Sen. Hickenlooper: There is something really novel, but something that should not be which requires the publication of real prices for health care procedures from patients and employers whose real visibility and therefore competition will allow for the best prices possible. You discussed the benefit of real transparency and what that can do about costs and increasing medication adherence.
▶ 0:47:29Sen. Hickenlooper: Do you worry that the current level of opacity, and I'm not sure if that is a real word, but the clouding over and hiding of costs in our health care system does not currently allow us to benefit from the necessary competition and the natural inclination of competition to lower prices?
▶ 0:47:47Dr. Keane: I share your concern and we appreciate the senate's focus on this. I had the opportunity to practice medicine in a -- and banner hospitals just north of denver and really love fort collins and almost moved to denver. It did not work out.
▶ 0:48:05Sen. Hickenlooper: You told me privately they had a miserable mayor. [laughter]
▶ 0:48:11Sen. Hickenlooper: He is still young. We might get him yet.
▶ 0:48:15Dr. Keane: Thank you. You just made my day. Obviously patients are empowered by price information and the extent to which we can provide that at the point of care and allow it for a shared decision-making about what the most appropriate therapy is, we will continue to do that. We are actually working with direct to consumer pricing.
▶ 0:48:43Dr. Keane: Information providers, trying to get not only a pharmacy benefit managers but the direct consumer pricing into the electronic health records. As you know, often times the amount that the patient will pay a co-pay will exceed the amount that they can pay for the drug. We believe the more information the patient has the better off they are and the better the adherence is. We appreciate your focus on this issue. It is the one area of this economy where pricing is opaque and we hope to change that.
▶ 0:49:13Sen. Hickenlooper: It is huge by most measures, even the medical association. It is approaching $5 trillion of spending every year. And when you think that 25% of that could be lack of efficiency or redundancy or fraud. That is a lot of money to capture. You are talking about somewhere in the trillion dollars a year category if that is accurate.
▶ 0:49:39Dr. Keane: The administrative burden related to health care is enormous and there is no reason it cannot be automated even using existing technology. The first step is getting the data captured and then getting exchanged by standards. Once that happens things like prior authorization, price discovery and other administrative functions and scheduling and appointments can be done in an automated fashion.
▶ 0:50:04Sen. Hickenlooper: I think you will be graded and preventing this once we get it passed. I am out of time, but the republican budget reconciliation bill makes of your funding cuts to rural hospitals and I think that is widely recognized and we are trying to figure out how to rectify it. I will submit some questions about how do we make sure that we get funding to rural hospitals so we do not see closures of hospitals and clinics in rural areas. One of the backbones of our country.
▶ 0:50:31Chair Cassidy: Thank you. I was a rural practitioner myself are a number of years and towns like ohio, and I understand the unique challenges that rural providers and patients face. It is my hope that during my tenure we can leverage information technology to close those gaps and we will be happy to provide what other technical existence that you will need.
▶ 0:50:55Sen. Hickenlooper: We will make sure to stay in close touch.
▶ 0:50:57Chair Cassidy: Thank you. Now, senator alsobrooks.
▶ 0:51:04Sen. Alsobrooks: Thank you Mr. chair. Digital tools and data systems are rapidly transforming health care in america, and when these technologies work well they can improve the patient and provider experience. When data systems fail, the consequences can be serious. Delayed care, privacy risks and clinician spending more time to have a date -- navigating technology than caring for patients.
▶ 0:51:32Sen. Alsobrooks: That means the policy should prioritize patient safety, clinical trust and the integrity of our health care system. As congress considers the future of health data and next-generation care, we need to ask a basic question, are we strengthening the guardrails or weakening them? Innovation without accountability does not build trust and in health care, trust is everything. So, you served with a former assistant secretary for technology.
▶ 0:52:02Dr. Keane: My former boss.
▶ 0:52:04Sen. Alsobrooks: In 2024, hhs elevated the office of national coordinator and expanded its authority to include technology, data and ai policy and strategy for the department. This was a timely reply internalization following the change health care data breach which compromise the personal data of nearly 200 million americans.
▶ 0:52:30Sen. Alsobrooks: The prior administration intended to move beyond a narrow focus on technical standards and better clarify the responsibility of disparate agencies for investing in technology, implementing it and establishing payment policies. All to help better align our federal response and preparedness for emergency threats.
▶ 0:52:50Sen. Alsobrooks: The idea that as health care becomes more digital and data-driven, hhs would need a forward-looking office, capable of shaping policy framework for technologies across the department. Would you share why it was important to create a centralized system within the department to better coordinate policy efforts across operating divisions?
▶ 0:53:12Dr. Keane: Thank you for the question. The office of national coordinator as the coordinator as the main portion of its role. Our ability to convene and work with our partners across hhs to promulgate standards that protect patient privacy and safety and prevent data breach is essential to our mission. We were doing this before the organization and after the organization.
▶ 0:53:40Dr. Keane: And we are doing everything we can to preserve patient privacy, security and make sure that all of the agencies are aligned around us. The specific agency that deals with cyber security breaches as the assistant secretary for preparedness and response and of course the fbi and cybersecurity and infrastructure security agency. We take these seriously, as do you and we appreciate your focus on.
▶ 0:54:06Sen. Alsobrooks: I am concerned this administration is showing signs of walking back from that progress and the will to align health agencies to best pack the patient -- to best protect patients. So does the department still believe -- let me move to another question. I want to ask you about guardrails.
▶ 0:54:28Sen. Alsobrooks: We are seeing ai embedded into clinical software systems used by doctors and nurses, meaning that these technologies are increasingly influencing diagnoses, treatment and care management. What role do you believe a.s.t -- astp should play in establishing guardrails to make sure these are trustworthy for clinicians and patients.
▶ 0:54:53Dr. Keane: As I was mentioning to chairman cassidy as a radiologist I've been using ai for 20 years and it has transformed the field. As a physician and somebody who helped select ai systems for radiology practices, we are forensic in examining what the ai is capable of doing and making sure that it helps us in our job and that it is safer patients.
▶ 0:55:21Dr. Keane: We believe we have a real role in believing that safety and privacy are protected by ai systems that we oversee. This is why we put out asking the broad public, doctors and nurses and patients, and developers what the best approach to regulating ai is, and we intend to use the information that we use not to only inform the regulatory regime, but also to share with congress and with our sister
▶ 0:55:51Dr. Keane: Agencies of hhs.
▶ 0:55:54Sen. Alsobrooks: Do you believe that the current authorities are sufficiently growing the use of ai in clinical settings? Are -- or are these gaps that congress should pay attention to?
▶ 0:56:08Dr. Keane: I believe that we will serve as that. I cannot comment on the authorities of other agencies. I believe within our agency we have sufficient authority is certify health I.t. And manage the nationwide network to make sure that the ai that is deployed is safe and effective.
▶ 0:56:28Dr. Keane: I can tell you that we collaborate closely with our colleagues at cms and with our colleagues at the fda and we help inform their thinking about how their regulation should be promulgated by will let those agencies speak about what they are doing.
▶ 0:56:44Chair Cassidy: Senator marshall.
▶ 0:56:47Sen. Marshall: I am enjoying this so much I get a second round. I think it is important to point out that we have two bills between our price tag bill and prior authorization bill that will literally change the health care experience for americans. And I appreciate the commitment to giving us a hearing very soon. A markup on our price tag bill and hoping we can figure a way to get prior authorization across the finish line as well.
▶ 0:57:19Sen. Marshall: I want to talk about interoperability. About the biggest failure was interoperability. When I made the decision for which one for our hospital. A physician owned hospital, they guaranteed me that it would be able to talk to all of the others. Indeed, we had to dodge and other hospitals had a ford and there were chevys and they did not talk to each other. We formed committees and prayed about it and threw money at it.
▶ 0:57:47Sen. Marshall: When I left the practice they were still not talking to each other and I am still not convinced that they are. I am frustrated that the department of defense are not all on the same emr and I know that they are trying to get there and it is huge hurdles. I cannot believe that is not accomplished. You would think if you are taking government -- money from the federal government it would be euro responsibility -- your ability to communicate with cms and that is your goal, right?
▶ 0:58:18Sen. Marshall: I wonder what is keeping us from doing that and I know you are making progress. What are the challenges ahead of you and what are -- how are you dealing with organizations that are blocking? Barry brodd, sorry.
▶ 0:58:31Dr. Keane: Thank you for the question and I see that you had the same experience as a physician that I have been hearing one thing from salespeople and finding another thing when you get the product. In order to make it work there has to be clear standards, which we are constantly refining and working with organizations to continue to develop. There has to be tools for conformance with those standards.
▶ 0:58:58Dr. Keane: And we fund and operate our own testing tools to make sure that, for example, when we promulgate a fire standard in our regulation that that fire standard actually conforms to buy all of the people who sign the certification.
▶ 0:59:16Dr. Keane: Additionally, we have to make sure that people are not willfully engaging in information blocking, which is why our efforts to enforce the information blocking regulations through issuing and this is potential nonconformance and consultation can prevent people who are --
▶ 0:59:32Sen. Marshall: There are three or four companies that control 80 or 90% of the emr's out there. Is there one not being cooperative? What can we do to encourage them to help unlock their codes?
▶ 0:59:46Dr. Keane: We do not pick winners and losers, and we work with the assumption that everybody wants to be a good actor in the market. When we find that people are thought by their exchange cross -- partners to be information blocking we informed them and discuss with them what we think they are doing incorrectly and if it comes to it we issue a notice of nonconformity and refer the case to the office of inspector general.
▶ 1:00:14Sen. Marshall: Have any of those cases gone forward?
▶ 1:00:17Dr. Keane: I cannot comment on what the office of inspector general is doing, because I am barred from knowing.
▶ 1:00:25Sen. Marshall: I do certainly think that there are bad actors and you are too kind. I appreciate that. I do think we should hold some of these companies accountable.
▶ 1:00:35Dr. Keane: Some of them have the notices landing on their desks so we will see how they react.
▶ 1:00:41Sen. Marshall: I think maybe the last thing I will talk about is my goal is that we truly have, you and I, that it is my record and it is a personalized medical record that I control. I think you were making steps in that direction. But, any ideas on how do we make that into reality?
▶ 1:01:07Sen. Marshall: Where it is truly my medical record and I do not have to call my doctors office and I am now sitting in an emergency room in washington, D.C. and all I have to say is here is my app, here is my medical record. And we will email it to you in whatever we have to do?
▶ 1:01:22Dr. Keane: Thank you for the question and concern with this issue. The network that we have stood up and continue to grow and during secretary kennedy's 10 year, the number of documents exchanged have gone up by a factor of 50 has a particular exchange purpose.
▶ 1:01:43Dr. Keane: The idea is that, consistent with the rule, a patient is able to get that information in a form that they want, including on their phone so they are empowered by that information and they can share it with a caregiver, provider or app individual access services are being built out.
▶ 1:02:03Dr. Keane: We are doing everything we can to address challenges of sharing across different systems, networks, organizations and geographies and we are making real progress with continued support with the senate and congress we should get it to the point where everyone is empowered by their health records.
▶ 1:02:18Sen. Marshall: Can you be more specific. What can we do? Is this financial resources?
▶ 1:02:24Dr. Keane: What we are doing at astp is looking at increasing the number of demographic variables to allow more reliable patient ranching and increasing the number of security control so people are willing to share. So in the event there is a suspected breach, the information does not get compromised. One of the challenges is that people are uncomfortable sharing information because they do not want improper sharing. Thank you.
▶ 1:02:55Chair Cassidy: Thank you, Dr. marshall. Senator murkowski.
▶ 1:03:01Sen. Murkowski: Welcome. A lot of interest in your testimony. I am sorry I have not been here for most of it, but my team has been following with great interest. Alaska got a lot of territory to cover. And the populations are very spread out. Small communities and access to providers is limited. We have been one of those who have pioneered a lot when it comes to telehealth and figuring things out that way.
▶ 1:03:30Sen. Murkowski: Part of the challenge is that in many parts of the state, it is tough to make the technology work because we are just not connected like the rest of the country is. As you are working to push out these advancements. I would ask that you keep in mind that those who stand to benefit most from digital health modernization might have the least capacity to do so.
▶ 1:03:59Sen. Murkowski: So, how we are knitting this altogether is where I am interested. We are looking at rural health transformation fund and seeing a lot of promise to that but also recognizing that we have a lot to do to just get to par with what many people in america have come to expect and be able to receive on these devices. In addition to our geography, we are blessed to have more veterans per capita than any other state.
▶ 1:04:30Sen. Murkowski: And we are also very fortunate to be the home of 200 29 federally recognized tribes, more than half of the tribes in the country. Both of these groups, the v.a. And ihs use government health systems. We talk about interoperability of our systems, and in fact, when you ask people how does this work they snort and say we talk a lot about it.
▶ 1:05:03Sen. Murkowski: But the seamless integration is not there. The question to you this morning is whether or not the multiple agencies have been engaged in this interoperability planning, the standards development that we are talking about, so we have broader alignment. What happens is that you are an alaskan native in a village, you are not going to have access to ihs.
▶ 1:05:32Sen. Murkowski: And so, the provider that sees you is not a v.a. Provider, blood and ihs provider. A non-native veteran in the village, is seen in the ihs clinic. There is no boundaries, which is great. But when we talk about systems, are we going to inadvertently possibly be creating some barriers? Have you thought about this?
▶ 1:05:58Dr. Keane: Thank you for the question and hopefully not. I should mention that this last christmas I got a gift of salmon from the wild alaska company, I think. It is fantastic stuff.
▶ 1:06:12Chair Cassidy: Was it below the gift limit?
▶ 1:06:16Sen. Murkowski: It came from a family member so I think it is kosher.
▶ 1:06:22Dr. Keane: So, I would like to say that we have a good collaboration with the indian health service. They are the first government organization to join. We have worked closely with them on their health I.t. Modernization efforts. We meet with them I believe monthly and give routine consultations on workforce needs and staffing needs. We help them pick their vendor, as well as their contractor.
▶ 1:06:54Dr. Keane: And, we are really interesting -- interested in maturing the interoperability between the indian health service and other providers. It is getting better and we would be happy to get them in s ight.
▶ 1:07:07Sen. Murkowski: I would appreciate knowing how things are advancing. I value what you are saying about early engagement with ihs. That is important. I am also the chairman of the senate indian affairs committee. And we talk a lot about tribal data privacy and sovereignty.
▶ 1:07:30Sen. Murkowski: And a recognition that historically, much of the data that comes from the tribal communities have been collected and managed by federal agencies and outside entities without the clear tribal governance and that creates issues in and of itself. And so, making sure that you are incorporating that or factoring that into the process along the way.
▶ 1:07:55Sen. Murkowski: I think it will be very important for what we can do to anticipate better health outcomes for tribal members.
▶ 1:08:03Dr. Keane: We are very focused on the privacy and security protections and I would love to work with your office to see how we can ensure that the data exchange with the tribes in the indian health service. As a former rural practitioner I am focused on making sure this works for everybody.
▶ 1:08:22Sen. Murkowski: And if I might use this for him invite further discussion with members of the indian affairs committee on these issues of tribal health information and privacy concerns, I look forward to that. Thank you so much for inviting him to the hearing today.
▶ 1:08:44Chair Cassidy: Thank you. Senator hawley.
▶ 1:08:51Sen. Hawley: Thank you for giving me the opportunity to ask questions. Thank you for your testimony and I'm sorry I am a bit late. Another committee hearing is going on and on. I want to talk to you about cybersecurity at rural hospitals. In missouri, 40% of our hospitals are rural, over 70. We have seen multiple cyber attacks.
▶ 1:09:16Sen. Hawley: Over the last three years, 60% of rural hospitals in the country they cyber attacks and that is a big number. There was a hospital near my state, at saint margaret's health that was forced to close its doors after he ransomware attack in 2021. Would you tell us about how cyber attacks on rural hospitals directly affect quality of care for the patients that they serve?
▶ 1:09:42Dr. Keane: There is no question that cyber security on any hospital, but particularly under resourced hospitals that typically serve rural populations how this could be devastating. The programs that we administer, we are laser focused to making sure that the data is protected and that systems are secure.
▶ 1:10:07Dr. Keane: Our current hdi5 -- hti5 rule is giving providers of electronic technology the opportunity to pivot away from box checking cyber security requirements to be consistent with the risk-based framework under the hipaa security rule. As you know, the rule requires transmission security and audit controls and access controls and the like.
▶ 1:10:34Dr. Keane: We want hospitals to be able to adopt the most advanced sort of security postures to prevent cyber attacks in the future. We would like the certification program to move at the pace of cybersecurity to ensure that these attacks are rare, if ever happen.
▶ 1:10:51Sen. Hawley: Let me just ask you, in your own priority is, in terms of their role as the assistant secretary, how does rural hospital cybersecurity factor? You said you would like to see the protocols be changed and updated to move with the pace of the threat. Tell us a little more.
▶ 1:11:12Dr. Keane: Our hti5 rule is updating the certification criteria, so that it can adopt the most modern standards for cybersecurity. For example, in our current program, we asked people to say if they use multifactor authentication or not. There are newer standards that cannot be phished.
▶ 1:11:39Dr. Keane: And what we like to do is make sure that the newer standards can be adopted as they come out through the certification program. As a rural provider myself, I was in a situation for a cybersecurity attack that happened in my hospital that shut us down for a day and a half. I lived through it and understand how serious these are and the problems with ransomware attacks.
▶ 1:12:04Dr. Keane: The attacks will always become more sophisticated, so we have to make sure that our cyber security and certification program keep up and the flexibilities are consistent with the security rules to allow that to happen.
▶ 1:12:18Sen. Hawley: In june, senator hassan and I introduced the cybersecurity -- the rural hospital cybersecurity act and it is awaiting action on the floor and senate and what it does in part is directs hhs to develop a comprehensive cybersecurity workforce strategy and development strategy that had a very minimum would consider public-part -- private partnerships and policy recommendations.
▶ 1:12:45Sen. Hawley: Can I ask you, with the development of a comprehensive workforce strategy like that, help your office further its goals of improving probably -- quality of care and optimizing systems?
▶ 1:12:56Dr. Keane: Thank you for the question and focus on cybersecurity and rural health care providers. I did it for the entire first part of my career. Anything the senate can do that can help us improve the cybersecurity posture of all hospitals particularly rural and underserved would be helpful. And we are happy to provide technical assistance on any legislation that you are considering.
▶ 1:13:21Sen. Hawley: Very good and I hope to see the bill passed the full senate and look forward to working with you on that. Mr. chairman. Thank you.
▶ 1:13:28Chair Cassidy: Thank you. I want to have a second round myself. First, I want to point out that the infrastructure investment and jobs act is dispensing money to make sure that everyone has access to high-speed affordable internet, so the rural patient in missouri and louisiana will now have access to telehealth and telemedical health.
▶ 1:13:53Chair Cassidy: So I do think that there is -- the operationalization of this is in the offing, so just to say that. And then, Dr. keane, we spoke about administrative burdens. I am told that astp-onc proposed a rule to remove 34 certification criteria required for health I.t. Products.
▶ 1:14:21Chair Cassidy: Some changes are far criteria no longer in effect, and others in crew -- include those related to privacy and security. What I do not know with the removal of these is it because they are merely a regulatory burden for people to bring in new products? Because sometimes regulations restrict market access.
▶ 1:14:45Chair Cassidy: Or, if the removal of these regulations mean that it will be less secure c1 thank you for the question. And for the opportunity to provide clarification. We believe that the pivot will allow for the most advanced cyber security posture.
▶ 1:15:16Chair Cassidy: To be introduced into the certification program. We had an assessment of all 60 certification criteria and we look for ones that were outdated or redundant or had become market-based or were not like that.
▶ 1:15:33Sen. Cassidy: That is not necessarily mean it is not valid.
▶ 1:15:37Dr. Keane: That is correct. If the uptake for a particular certification criteria is low, it is not having an impact on the market. It does not mean that it is deployed. We have a criteria that asks developers if they support multifactor authentication.
▶ 1:16:08Dr. Keane: We do not require them to do that. About has to do in halftones. Very few actually deploy these in actual hospital settings. As you know having practiced, the reason is it is very hard to do multifactor authentication. There are very strong privacy and security protections within the hospitals themselves.
▶ 1:16:35Dr. Keane: Increasingly, hospitals are taking on security postures which are more advanced. All of this is observed by the security rules. Which require transmission security and control. Access controls.
▶ 1:16:56Dr. Keane: I will not bore you with things like transport layer security but as these technologies evolve, we want to make sure that the governing law is the one that everyone adheres to.
▶ 1:17:11Sen. Cassidy: It is not that we are relaxing?
▶ 1:17:15Dr. Keane: Absolutely not.
▶ 1:17:18Sen. Cassidy: Let me ask you this. We talked about somebody uploading their personal information to an ai platform that can then integrate their data. Under hipaa, would that be a covered entity with all the protections to the patient's data that is implied by being a covered entity or not?
▶ 1:17:45Dr. Keane: Thank you for the question. Cmmi just released their access model in which individual apps can enroll as part b providers in medicare to get some compensation. Under the situation those apps are covered by hipaa. A large portion of that is not covered.
▶ 1:18:15Dr. Keane: Hipaa does not supply to that.
▶ 1:18:20Sen. Cassidy: Can that be done by rule? >> you mentioned earlier the need for privacy to be protected. There is not philosophically a difference between an app which is required to be hipaa compliant and ai that is being uploaded to an can use my data.
▶ 1:18:48Sen. Cassidy: It is not supposed to be commercialized or used for marketing. But it could be by someone who is willing to push the envelope.
▶ 1:18:59Dr. Keane: Patients at metonymy and other data is used. I think it is important for the patient understand how it is used.
▶ 1:19:10Sen. Cassidy: I find that most patients are not aware of these issues. You and I live and breathe them. But unless you are an engineer, most people are not going to understand the implications of putting my genetic data of their wish then ai could figure out.
▶ 1:19:41Sen. Cassidy: They could potentially redline it for insurance because even though we have a law against it, somehow they can work around. I do think there is some consumer safeguards that should be implemented like a fox that pops up. It will not be accessible for marketing and as you say not. ?
▶ 1:20:09Do You Dr. Keane: Agree Dr.
▶ 1:20:10Keane: Or disagree we agree that anything that improves the security posture of patients is something worth looking at is something we support. I can tell you that we are laser focused on it. With the programs that we administered.
▶ 1:20:25Sen. Cassidy: Do you need new authorities for that it does congress need to pass a law or is it even philosophically where you are because the previous directors seem to feel like a libertarian, the patient could do whatever he wanted with the data. I do know if they know they are doing with their data.
▶ 1:20:42Dr. Keane: As someone who has practiced medicine for two decades, I understand that patients don't always understand whether -- where their data is going.
▶ 1:20:54Sen. Cassidy: Do you need more authority or can you do it with your current authority?
▶ 1:20:59Dr. Keane: I don't think we are able to regulate data that the patient has consented to be released. With the standards that we promulgate we can create a clean surface on which any future regulation or legislation can actually be effective.
▶ 1:21:17Sen. Cassidy: I am a techno-optimist when it comes to ai. But the old principle is that bad money drives out good. It forces people to go to the lowest common denominator.
▶ 1:21:32Dr. Keane: We appreciate your focus on that.
▶ 1:21:36Sen. Cassidy: For any senator asking additional questions, questions for the record I due at 5:00 p.m.. Thank you for being here.
▶ 1:21:46Dr. Keane: Thank you so much.
▶ 1:21:48Sen. Cassidy: Thank you. [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy. Visit ncicap.org]