DS 17 Guide Data Sharing for Drowning Prevention within Privacy Regulations

Evidence:

Any health information generated or held by a covered entity that could be linked to an individual is protected health information (PHI). HIPAA (HHS 2013a) defines PHI as "any information" related to the "past, present or future physical or mental health condition" of a person. Only fully de-identified information is excluded, where every explicit identifier has been removed, as well as data that could potentially establish identity via statistical techniques. Under the Health Information Technology for Economic and Clinical Health (HITECH) Act’s amendments to HIPAA, patients now have a right to request electronic copies of records where the covered entity has an electronic records system.

However, per 45 CFR 164.512(b), The Privacy Rule permits covered entities to disclose protected health information, without authorization, to public health authorities who are legally authorized to receive such reports for the purpose of preventing or controlling disease, injury, or disability. This would include, for example, the reporting of a disease or injury; reporting vital events, such as births or deaths; and conducting public health surveillance, investigations, or interventions. Drowning is reportable in only some states such as Texas (within 10 days) and Ohio. State laws that are contrary to the Privacy Rule are preempted by the Federal requirements, unless a specific exception applies. These exceptions include if the State law provides for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention.

 A “public health authority” is an agency or authority of the United States government, a State, a territory, a political subdivision of a State or territory, or Indian tribe that is responsible for public health matters as part of its official mandate, as well as a person or entity acting under a grant of authority from, or under a contract with, a public health agency (see 45 CFR 164.501). Examples of a public health authority include State and local health departments, the Food and Drug Administration (FDA), the Centers for Disease Control and Prevention, and the Occupational Safety and Health Administration (OSHA).

Covered entities are required reasonably to limit the protected health information disclosed for public health purposes to the minimum amount necessary to accomplish the public health purpose. For routine and recurring public health disclosures, covered entities may develop standard protocols, as part of their minimum necessary policies and procedures, that address the types and amount of protected health information that may be disclosed for such purposes. Constraints flow from non-government sources as well, such as certification organizations like The Joint Commission and medical organizations such as the American Medical Association.

Research involving deceased individuals is not human subjects research according to 45 CFR 46.102(f) and does not require IRB oversight unless the research involves both living and deceased individuals. However, to maintain the privacy of the PHI of the deceased, and to maintain the confidentiality of the deceased subject’s family, research that uses the deceased subject’s data should be undertaken only if the information is de-identified by an honest broker service, or, is pursuant to a valid research authorization signed by the administrator or executor of the deceased individual’s estate or the person who is listed as next of kin.