132 Annual Meeting Logo - Go to APHA Meeting Page  
APHA Logo - Go to APHA Home Page

How to meet various public health reporting needs without violating applicable federal privacy and confidentiality regulations

Robin Frazier Kandel, JD, Attorney and Assistant Director for Legal Affairs, Social and Health Services, Ltd., a Division of ORC Macro, 11426 Rockville Pike, Rockville, MD 20852, 301-770-5800 (5257), rkandel@shs.net and Brian J. Balicki, MHS, Social and Health Services, Ltd., a division of ORC Macro, 11426 Rockville Pike, Rockville, MD 20852.

The enforcement of the Health Insurance Portability and Accountability Act’s (HIPAA’s) privacy regulations within 45 C.F.R. Parts 160 & 164 is currently raising many questions and some misconception with regard to how these regulations impact various types of public health reporting. And, further questions are raised by professionals who are also governed by the alcohol and drug confidentiality regulations within 42 C.F.R. Part 2, with regard to how HIPAA privacy impacts 42 C.F.R. Part 2 in this regard. Generally, both sets of regulations are structured in terms of setting forth a general prohibition against the use and disclosure of individually identifiable health information, with various exceptions in which use/disclosure is otherwise permitted (and/or, in the case of HIPAA, required in limited instances). The exceptions within the two separate federal regulations differ greatly, primarily due to the very different goals for which each set of regulations was designed. There are different exceptions within each of these regulations in which diverse public health reporting needs can be met. In addition, the HIPAA privacy rule places an obligation on covered entities to provide to an individual, upon request, with an accounting of various disclosures. Many of the HIPAA exceptions under which public health reporting can be accomplished (e.g., public health activities exception, averting a serious health or safety threat exception, required by law exception, or even potential reports to a public health agency that may also be a business associate of the covered entity), will invoke the need for an accounting.

Learning Objectives:

Keywords: Privacy, Reporting

Presenting author's disclosure statement:
I have a significant financial interest/arrangement or affiliation with any organization/institution whose products or services are being discussed in this session.
Relationship: I am an employee of SHS/OCR Macro, and a contractor for CSAT/SAMHSA in its Confidentiality and Ethics Training Project (Contract # 270-03-7112). Charts I developed and which were approved for use in our SAMHSA training project on alcohol and drug confide

Public Health Data and Privacy

The 132nd Annual Meeting (November 6-10, 2004) of APHA