Date post: | 26-Mar-2015 |
Category: |
Documents |
Upload: | brooke-craig |
View: | 220 times |
Download: | 0 times |
1
The HIPAA Privacy Rule:Scope, Structure, and
ImplementationJames G. Hodge, Jr., J.D., LL.M.
Associate Professor, Johns Hopkins Bloomberg School of Public Health;
Executive Director, Center for Law and the Public’s Health
at Georgetown and Johns Hopkins Universities
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
2
Principle Objectives
Discuss basic principles of health information privacy, confidentiality, and security.
Briefly assess the existing universe of legal protections for the privacy and confidentiality of health data.
Examine the scope, structure, and implementation of the HIPAA Privacy Rule.
Discuss the impact of the HIPAA Privacy Rule on public health authorities.
Explore the distinctions between public health practice and public health research for the purposes of applying privacy laws and policies.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
3
Health Information Privacy - Key Terms
• Privacy - an individual’s right to control their identifiable health information.
• Confidentiality - privacy interests that arise from a specific relationship (e.g., doctor/patient, researcher/subject) and corresponding legal and ethical duties.
• Security - technological or administrative safeguards or tools to protect identifiable health information from unwarranted access or disclosure.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
4
Health Information Privacy - Key Terms
If the security safeguards in an automated system fail or are compromised, a breach of confidentiality can occur and the privacy of data subjects invaded.
• Willis Ware, Lessons for the Future: Dimensions of Medical Record Keeping, in Health Records: Social Needs and Personal Privacy 43 (Task Force on Privacy, U.S. Department of Health and Human Services (1993) (http://aspe.hhs.gov/pic/pdf/4441.pdf
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
5
Health Information Privacy - Key Concepts
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
Disclosure
6
Health Information Privacy - Key Concepts
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
Storage
Acquisition Use
Disclosure
7
Risks to Health Information Privacy
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
• Accessibility and intimate nature of health data combine to cause social, psychological, and economic harms to those whose privacy is violated.
•Emerging computer technologies and the development of longitudinal individual health records and national electronic health information infrastructures are perceived by many to threaten individual privacy.
8
Synergies of Health Information Privacy
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
• Absent privacy protections, patients and others will avoid some clinical, public health, and research interventions.
• Only through the responsible sharing of some health data may improvements in health care and community health be made.
9
Health Information Privacy - Communal Needs for Identifiable Health Data
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
Individual privacy protections must be balanced with legitimate communal uses of health data like health research and public health.
10
The Universe of Health Information Privacy Laws
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
A host of laws of every type at every level of government, affecting multiple types of entities, and covering an array of health data are all part of the universe of health information privacy laws
11
The Universe of Health Information Privacy Laws – Types of Laws
Compacts
Cases
Policies Regulations
Statutes
Constitutions
Treaties
Types of Laws
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
12
The Universe of Health Information Privacy Laws – Levels of Government
Community
City
County Tribal
State
National
International
Govern-ment
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
13
The Universe of Health Information Privacy Laws – Regulated Entities
Health Insurers
Private Industries
NGOsHealth
Providers
National Security
Law Enforcement
Researchers
Public Health
Entities
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
14
The Universe of Health Information Privacy Laws – Types of Health Data
BirthDefects
Clinical
Mental Health
HIV/AIDS
Cancer
Genetic
Research
Public Health
Types of Data
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
15
The Universe of Health Information Privacy Laws
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
Basic observations underlying these laws:• Focus on individual (as contrasted with group) privacy interests• Identifiable health data is defined in different ways• Extent of privacy protections varies• Failure to address modern health information exchanges• Consistent need to balance individual and communal interests in health data
16
Health Information Privacy - Modern Protections
HIPAAThe Health Insurance Portability
and Accountability Act of 1996
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
17
HIPAA and the Basis for Health Info. Privacy
HIPAA seeks to:> Increase access to health insurance
> By reducing insurance costs> By lowering administrative costs
> By transmitting electronic data > Under
enhanced health info. privacy protections
> That encourage people to seek health care
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
18
Health Information Privacy - Modern Protections
HIPAA [includes]
Administrative Simplification Provisions [which required the production of]
Standards for Privacy of Identifiable Health Info. [also known as]
Health Information Privacy Regulations [located at]
45 CFR Parts 160 – 164[and known collectively as the]
Privacy Rule
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
19
HIPAA Privacy Rule – A Brief Timeline
• August, 21, 1996. HIPAA passes Congress and was signed into law. • August 21, 1999. Congress fails to pass health info. privacy law.• August, 1999 - January, 2001. Absent Congressional action, DHHS
was authorized to produce administrative regulations.• April 14, 2001. After months of work and public commentary,
DHHS finalizes its Privacy Rule with President Bush’s approval.• August 14, 2002. Bush administration modifies original Rule.• April 14, 2003. The Rule becomes effective for most “covered
entities” [or one year later for small health plans].• April 14, 2004. The Rule is fully effective for all covered entities.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
20
HIPAA Privacy Rule – Scope, Structure, and Implementation
• What is covered?• Who is covered?• How is it covered?• How are disclosures/uses
regulated?• What about other laws?• What about violations?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
21
What Is Covered?
“Protected Health Information (PHI)”
individually-identifiable health information used or disclosed by a covered entity in any form, whether electronically, on paper, or orally.
45 C.F.R. 160.103
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
22
What Is Not Covered?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
PHI does not include:
•Education records covered by FERPA;
•Employment records held by a covered entity in its role as employer;
•Non-identifiable health information
45 C.F.R. 160.103
23
Who Is Covered?
“Covered Entities (CEs): Health Plans Health Care Clearinghouses Health Providers - that exchange
identifiable health data electronically and their business associates
45 C.F.R. 160.103
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
24
Who Is Covered?
Business associates include: Claims or data processors Billing companies Quality assurance providers Utilization reviewers Lawyers Accountants Financial service providers
45 C.F.R. 160.103The Center for Law & the Public’s Health
at Georgetown& Johns Hopkins UniversitiesCDC Collaborating Center Promoting Health through Law
WHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
25
Who Is Covered?
Beyond CE’s and their Business Associates are those who engage in:
Covered functions – those functions of a covered entity the performance of which makes the entity a health plan, health care providers, or health care clearinghouse. 45 CFR 164.103
Hybrid entities performing “covered functions” may have to adhere to relevant portions of the Privacy Rule to the extent to which some part of the entity conducts these activities.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
26
Who Is Not Covered?
• Life insurances companies• Auto insurance companies• Worker’s compensation carriers• Employers • Others who may still acquire, use, and disclose vast quantities of health data
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
27
How is PHI Covered?
Boundaries - setting limits on uses and disclosures
Security - imposing security requirements
Fair Information Practices - allowing individuals some level of access to their health data
Accountability - making covered entities accountable for handling and abuses
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
28
How Are Uses/Disclosures Regulated?
Use – the sharing, employment, application, utilization, examination, or analysis of PHI within an entity
Disclosure – the release, transfer, provision of, access to, or divulging in any other manner of PHI outside the entity holding it.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
29
How Are Uses/Disclosures Regulated?
Acquisition? Use
Disclosure – the release, transfer, provision of,access to, or divulging in any other manner of
PHI outside the entity holding it.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
30
How Are Uses/Disclosures Regulated?
Acquisition = Disclosure
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
31
How Are Uses/Disclosures Regulated?
CEs may use or disclose PHI without individual written authorization to carry out treatment, payment, or health care operations (aka. Standard transactions).
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
32
How Are Uses/Disclosures Regulated?
Otherwise, uses or disclosures of PHI require either individual opportunities to object or written authorizations pursuant to the “anti-disclosure rule.”
“Except as otherwise permitted or required. . . , a CE may not use or disclose PHI without an authorization . . . “
45 CFR 164.508(a)(1) The Center for Law & the Public’s Health
at Georgetown& Johns Hopkins UniversitiesCDC Collaborating Center Promoting Health through Law
WHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
33
How are Uses/Disclosures Regulated?
Some exceptions to the anti-disclosure rule:• Law Enforcement• Judicial and Administrative Proceedings• Decedents• Health emergencies• Limited Commercial Marketing• Minors• Health Research• Public Health
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
34
What About Other Laws?
Federal/State ConstitutionsFederal/State Statutory Laws
Federal/State Administrative Laws Federal/State Judicial Law
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
35
Does the Privacy Rule Supplant These Laws?
NoThe Privacy Rule creates a floor of federal protections.Existing federal or state laws that provide greater health information privacy protections or do not otherwise conflict with the Rule remain in effect. Like a patchwork quilt, they lay over Privacy Rule protections.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
36
What About Violations?
Violations or breaches of the Privacy Rule may result in:
• Complaints filed with the Secretary of HHS;• Ensuing investigation by the Secretary;• Compliance reviews by the Secretary;• Informal resolution by the Secretary whenever possible;
and• Imposition of civil penalties, which can be collected
through release of federal debts owed to the entity.• Criminal sanctions against individuals 45 CFR 160.300-.500
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
37
What About Violations?
Beyond formal or informal approaches to addressing violations pursuant to the Privacy Rule are:
• Judicial uses of the Privacy Rule as a per se standard for protecting health information privacy
• Contractual obligations to adhere to the Privacy Rule Business Associates Limited Data Sets
• Institutional, corporate, and organizational policies requiring adherence to the Rule
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
38
Impact of the Privacy Rule on Public Health
Externally – how does the Rule impact the flow of identifiable health data into or out of public health agencies?
Internally – what are ways that the Rule affects the practice of public health or public health research done by public health agencies or its partners?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
39
Impact of the Privacy Rule on Public Health
Public Health Practice - Externally
How does the Privacy Rule affect the flow of health data to public health authorities?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
40
The “Public Health” Exception
The “public health” exception [to the anti-disclosure rule] states that a covered entity may disclose PHI without specific, individual authorization to a “public health authority that is authorized by law to collect and receive such information for the purpose of preventing and controlling disease, injury, or disability, including . . . reporting of disease . . . and the conduct of public health surveillance . . . .”
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
41
The “Public Health” Exception
Beyond this general authorization, additional, specific public health-based exceptions include:
• Disclosures to maintain the quality, safety, or effectiveness of FDA products
• Disclosures to notify persons exposed to communicable diseases
• Disclosures concerning work-related injuries• Disclosures about victims of abuse, neglect, or domestic
violence• Disclosures for health oversight activities• Disclosures to prevent serious threats to persons or the
publicThe Center for Law & the Public’s Health
at Georgetown& Johns Hopkins UniversitiesCDC Collaborating Center Promoting Health through Law
WHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
42
Who Is a Public Health Authority?
A public health authority is an:
agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency . . . that is responsible for public health matters as part of its official mandate.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
43
Who Is a Public Health Authority?
Public health authorities include:
• State or Tribal Health Departments• Local Health Departments• Contractors/others acting under authority of these
agencies
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
44
What About State Public Health Reporting Laws?
The Privacy Rule does not pre-empt (or override) state law that “provides for the reporting of disease or injury . . . or for the conduct of public health surveillance [or] investigation . . . .”
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
45
Impact of the Privacy Rule on Public Health
Public Health Practice - InternallyTo the extent that public health authorities use or disclose identifiable health data for public health purposes, they are not “covered entities,” and are thus not required to adhere to the provisions of the Privacy Rule.
Simply stated, public health authorities doing public health things are not covered by the Rule.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
46
Internal Impact of the Privacy Rule on Public Health
Public Health Authorities As Providers/Plans
A profound area of potential impact concerns the activities of public health authorities that resemble the provision of health care (e.g. direct delivery of health services to disadvantaged individuals) or administration of health plans (e.g., state “well person” programs).
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
47
Internal Impact of the Privacy Rule on Public Health
PH authorities performing health care activities or acting as a health plan are engaged in “covered functions,” and accordingly must adhere to the Privacy Rule.
Most public health authorities at the state and local levels declare themselves as hybrid entities (or multi-functional organizations with covered entity components) pursuant to the Rule.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
48
Internal Impact of the Privacy Rule on Public Health
PH Authorities Doing Health Care/Plan ActivitiesAs Hybrid Entities
The practical effect of hybrid status is that thepublic health agency designates thosecomponents of its practices that are covered, andadheres to the Rule concerning those components.
Others within the agency may not have to adhereto the same requirements concerning their duties,although the agency is responsible for theircompliance with covered applications.The Center for Law & the Public’s Health
at Georgetown& Johns Hopkins UniversitiesCDC Collaborating Center Promoting Health through Law
WHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
49
Distinguishing Public Health Practice vs. Research
The HIPAA Privacy Rule provides different standards for disclosing PHI without authorization for public health vs. research purposes.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
50
Distinguishing Public Health Practice vs. Research Disclosures for research purposes are
more restrictive: IRB or Privacy Board Approval – that the use or
disclosure of PHI involves no more than a minimal risk to individual privacy based on: an adequate plan to protect the identifiers from
improper use and disclosure; an adequate plan to destroy identifiers asap; adequate written assurances that PHI will not be
reused or disclosed to anyone else except as required by law.
Preparatory to Research Research on Decedents Limited Data Sets
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
51
Distinguishing Public Health Practice vs. Research Neither the HIPAA Privacy Rule nor the federal Common
Rule (regulating the performance or funding of human subjects research by most federal agencies) clearly distinguishes public health practice activities from research activities.
Several dilemmas arise: Public health practice activities that assimilate
research activities, such as some types of surveillance, may be misconstrued;
Covered entities may deny access to PHI to public health authorities on the grounds that the requested bases for the data is research, and not practice; and
Public health practice activities may ultimately be submitted for IRB approval as if they are research.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
52
Distinguishing Public Health Practice vs. Research
A Report for Public Health Practitioners Including Case Studies and Guidance for Making Distinctions (2004)
Sponsored by the Council of State and Territorial Epidemiologists (CSTE), Atlanta, GA
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
53
Principal Objectives
To assess legal and ethical environments underlying public health practice and human subject research
To clarify existing definitions of public health practice and research
To provide meaningful cases on practice and research
To make distinctions between public health practice and research through foundational and enhanced guidance
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
54
Public Health Practice
The collection and analysis of identifiable health data by a public health authority for the purpose of protecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
55
Public Health Research
The systematic collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will primarily benefit those beyond the participating community who bear the risks of participation
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
56
Guiding Principles
Essential Features (e.g. foundations) of Public Health Practice and Research
Enhanced Guidelines
Checklist
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
57
Essential Features
Foundations of Public Health Practice Involves specific legal authorization at the
federal, state or local levels; Includes a corresponding governmental
duty to perform the activity to protect the public’s health;
Involves direct performance or oversight by a governmental public health authority (or its authorized partner) and accountability to the public for its performance;
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
58
Essential Features
Foundations of Public Health Practice (cont.)
May legitimately involve persons who did not specifically volunteer to participate (i.e., they did not provide informed consent);
Supported by principles of public health ethics that focus on populations while respecting individual rights; and
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
59
Essential Features
Foundations of Human Subjects Research Involves living individuals or identifiable
information about them; Involves identifiable data that are not publicly
available or for which the individual has not already consented to their use for research purposes;
Involves research subjects who voluntarily participate (or participate with the consent of their guardian), absent a waiver; and
Supported by principles of bioethics that focus on individual interests while balancing the communal value of research.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
60
Enhanced Guidelines
General Legal Authority – is there some general legal authority for the performance of the activity?
Relationships/Accountability – what is the proposed relationship of the actors to those participating in the activity? Who is accountable for the health and safety of participants?
Specific Intent – what is the specific intent of the actors performing the study?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
61
Enhanced Guidelines
Specific Intent -
The intent of research is to test a hypothesis and seek to generalize the findings or acquired knowledge beyond the activity’s participants.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
62
Enhanced Guidelines
Specific Intent -
The intent of public health practice is to assure the conditions in which people can be healthy through public health efforts that are primarily aimed at preventing known or suspected injuries, diseases, or other conditions, or promoting the health of a particular community.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
63
Enhanced Guidelines
Participant Benefits – is the activity designed to produce some benefit to the participants or their population?
Interventions – is the activity designed to introduce some non-standard or experimental methods or analyses to participants or their identifiable data?
Subject Selection – are the participants selected randomly so that the results of the activity can be generalized to a larger population?
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
64
Checklist
Step 1 - Check Key Assumptions Step 2 - Assess the Foundations of
Public Health Practice Step 3 - Assess the Foundations of
Human Subject Research Step 4 - Consider Enhanced Guidance Step 5 - Conclusions
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
65
Distinguishing Public Health Practice vs. Research Checklist
Key Update – Presently, the Office for Human Research Protections (OHRP) is working internally with federal agencies to review the bases for distinguishing research and non-research activities (including public health practice activities). OHRP is expected to release new guidance on these issues for public review and comment later this year.
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
66
Conclusions
• The HIPAA Privacy Rule Presents National Health Information Privacy Standards
• The Rule Creates a Floor for Privacy Protections• Existing Legal Protections at the Federal or
State Level May Remain Effective• The Rule Impacts Public Health in Practice,
Research, and Health Care/Plan Capacities in Multiple Ways
• Distinguishing Public Health Practice and Research Is Essential to the Application of the Rule.
• For more information, please contact me at [email protected]
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights
The Center for Law & the Public’s Healthat Georgetown& Johns Hopkins Universities
CDC Collaborating Center Promoting Health through LawWHO/PAHO Collaborating Center on Public Health Law and Human Rights