Breach reporting critical

At the same time, Baker said VA has to encourage vendors and others to report breaches, "because we can't mitigate the issue unless we know about it."

VA has required the security clause in contracts after November 2008 and last year reviewed contracts to make sure they contained the clause. Out of more than 22,000 contracts reviewed, vendors in 578 contracts refused or did not believe that their services required adhering to the clause, said Frederick Downs Jr., chief procurement and clinical logistics officer in the Veterans Health Administration.

"The 578 contracts were critical to our medical centers' ability to provide patient care," he said. The contracts were for direct healthcare services for nursing homes, hospices and physicians or to support maintenance for MRIs and CT scans.

"We had to weigh that because the risk of not having the contracts was high," Downs said, adding that VA has since clarified guidance for when the information security clause applies to healthcare contracts.

Rep. Steve Buyer (R-Ind.) questioned Baker about what a VA medical center should do when a contractor who delivers a radiologic service refuses to sign the information security clause.

"That is the challenge writ large across the organization with this information," Baker said. "How do we do great medical care and protect the information at the same time?"

The primary purpose of sensitive health information is to provide specific care for veterans. "We have to protect that information from unwanted access at the same time that we provide it to any one who needs to use it," he said.

Medical devices, which are certified by the Food and Drug Administration, add another layer of complexity to providing comprehensive information security. Some vendors who provide or support medical devices for VA cite FDA authority in refusing the VA security clause.

"We have to be careful from an IT perspective how we interact with the medical technology," Baker said. For example, VA can't apply patches to medical technology because it could have unknown effects on, say, an MRI machine.

It's an issue that "VA today is tackling in advance of the rest of the country," he said.