### HIPAA Compliance For State Government Agencies

##### Key Issues in the Use and Disclosure of Protected Health Information

####### [SECTION ONE]{.underline}: STATE CHECKLIST ON STATUTES OR REGULATIONS ADDRESSING CONFIDENTIALITY AND/OR PRIVACY OF INFORMATION

**Do the statutes and regulations in your state offer additional rights
or protections related to** **the following issues?**

If the answer is "yes," cite to statute and/or regulation and complete
the appropriate columns.

<table>
<colgroup>
<col style="width: 4%" />
<col style="width: 26%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 4%" />
<col style="width: 0%" />
<col style="width: 13%" />
<col style="width: 11%" />
<col style="width: 0%" />
<col style="width: 17%" />
<col style="width: 15%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"><h2 id="is-there-a-state-statute-or-regulation">Is there
a state statute or regulation</h2>
<h2
id="governing-confidentialityprivacy-of-information-in-any-of-the-following-areas">Governing
confidentiality/privacy of information in any of the following
areas:</h2></th>
<th><h2 id="no">No</h2></th>
<th colspan="2"><h6 id="yes">Yes</h6></th>
<th colspan="2"><p>Statute and / or regulation</p>
<p>citation</p></th>
<th><h2 id="does-it-address">Does it address</h2>
<h6 id="privacy">Privacy?</h6></th>
<th colspan="2">Does it address information gathering and sharing ?</th>
<th><p>Is it more stringent</p>
<h2 id="than-hipaa">than HIPAA ?</h2></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>1</td>
<td>Constitutional provision</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>2</td>
<td>Mental health records, including laws regarding the developmentally
disabled</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>3</td>
<td>Psychotherapy notes</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>4</td>
<td>Alcoholism and substance abuse records</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>5</td>
<td>AIDS and HIV confidentiality</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>6</td>
<td>AIDS testing</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>7</td>
<td>Registries (e.g., AIDS, cancer, sex offenders etc.)</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>8</td>
<td>Privacy rights of unemancipated minors</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>9</td>
<td>Vital Records</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>10</td>
<td>Sexually transmitted diseases</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>11</td>
<td>Communicable disease control</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>12</td>
<td>Local Health Departments</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>13</td>
<td>Reporting of abused or neglected children</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>14</td>
<td>Reporting, disclosing, and/or intervention for elder abuse</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>15</td>
<td>Reporting, disclosing, and/or intervention for domestic abuse</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>16</td>
<td>Rights of Committed Persons</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>17</td>
<td>Secure residential youth care facilities</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>18</td>
<td>State police powers &amp; duties</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td>19</td>
<td>Patients’ Rights, including the right of individual to access and
copy own records</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td>20</td>
<td>State Employment Agency/Dept. of Labor</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>21</td>
<td>PHI obtained by or under control of insurer data repositories</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>22</td>
<td>Sharing of PHI for administrative purposes</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>23</td>
<td>Arrest records</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>24</td>
<td>Conviction records</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>25</td>
<td>Criminal justice information authorities</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>26</td>
<td>Medical Records laws, including access, copying and inspection</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>27</td>
<td>Peer review and quality assurance</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>28</td>
<td>Sentinel event reporting</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>29</td>
<td>Licensing of health facilities</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>30</td>
<td>State OIG mandatory reports and/or investigations</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>31</td>
<td>Electronic transactions</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>32</td>
<td>Data repositories</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>33</td>
<td>Public assistance</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>34</td>
<td>Laboratories</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>33</td>
<td>Credentialing</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>34</td>
<td>Guardianship/advocacy commissions or investigatory bodies</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="odd">
<td>35</td>
<td>Intergovernmental cooperation legislation</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
<td></td>
</tr>
<tr class="even">
<td>36</td>
<td>State agency enabling legislation</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td></td>
<td></td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>

####### [SECTION TWO]{.underline}: STATES SHOULD EVALUATE THE PURPOSE FOR DATA SHARING OR DATA GATHERING TO DETERMINE STATE AND FEDERAL DISCLOSURE RULES. 

1.  Is the information for auditing purposes?

2.  Is the information for program evaluation purposes?

3.  Is the information for licensing compliance purposes?

4.  Is the information for research purposes?

5.  Is the information for statistics gathering?

6.  Is the information for state planning purposes?

7.  Is the information for state budgeting purposes?

8.  Is the information for federal reporting requirements?

9.  Is the information for federal funding requests?

10. Is the information for payment/financial transactions with other
    state agencies?

11. Is the information for payment/financial transactions with third
    parties?

12. Is the information for contracting?

13. Is the information for investigating civilly or criminally a
    patient?

14. Is the information for investigating civilly or criminally a
    program?

15. Is the information for determining individual eligibility for
    programs or funding?

16. Is the information for gathering information for individual
    assessment?

17. Is the information for communicating progress of cross systems
    clients?

18. Is the information for public reports?

19. Is the information for public education?

20. Is the information for compliance / enforcement of state laws?

21. Is the information for compliance / enforcement of federal laws?

22. Is the information for compliance with a court order?