# Presentation: 683183

## HIPAA, FERPA, and the Sharing of Immunization Data

-  Gail Horlick, M.S.W., J.D.
-  2004 Immunization Registry Conference
- Atlanta, GA.         October 20, 2004
- Disclaimer: This presentation provides basic information about certain provisions of the Privacy Rule in the context of public health.  It should not be construed as a formal training session that would meet the Rule’s training requirements nor should it be construed to give advice to covered entities.  Those who must comply with the Privacy Rule are encouraged to seek legal counsel to determine how the Privacy Rule could apply to a specific activity.   This presentation has not been cleared by HHS/OCR.

## Overview

- HIPAA Privacy Rule
- FERPA
- Laws governing transfer of immunization information:
- To and from public health
- To and from schools
- Summary of laws
- Recommendations to Secretary HHS
- Resources

## HIPAA Privacy Rule

- Regulation developed pursuant to Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- All entities covered by Rule must now comply
- Different compliance dates for other HIPAA rules
- E.g. 4/05 compliance date for Security Rule

## The HIPAA Privacy Rule 

- Privacy Rule governs use and disclosure of Protected Health Information (PHI)
- Protects all individually identifiable health information, in any medium, that is held or transmitted by an entity covered by the Rule
- Provides a federal minimum level of privacy protection
- Does not preempt more stringent state privacy laws
- Does not preempt existing public health laws

## Scope of HIPAA Privacy Rule

- Rule applies to Covered Entities (CE):
- Health plans
- Health care clearinghouses
- Health care providers (those who transmit certain health claims information electronically)
- Many provisions of rule apply indirectly to Business Associates (BA) hired to perform functions or activities on behalf of CE
- e.g. legal or accounting services, utilization review, claims processing
- CE needs satisfactory assurance, usually a  contract or MOU, that BA will safeguard information

## FERPA

- Family Educational Rights and Privacy Act (FERPA) (20 USC §1232g, 34 CFR Part 99):
- Federal law that protects privacy of school education record
- Affords parents rights to access, request amendments to, and exercise some control over disclosure of personally identifiable information from child’s education record
- Governs disclosure of information from education record
- Applies when school receives federal funds

## Relationship of HIPAA and FERPA

- Under HIPAA, CE is subject to other federal laws and regulations but HIPAA _excludes_ records covered by FERPA
- Information in education record is EXEMPT from HIPAA requirements

## Impact of HIPAA and FERPA on Sharing of Immunization Data

- HIPAA governs the disclosure of immunization information:
- From CE (provider) to public health
- From CE (provider) to schools
- From _some_ public health entities
- FERPA governs the disclosure of information from the education record
- includes immunization information

## Laws Governing the Transfer of Immunization Information

- Disclosure to public health: HIPAA and state/ local law
- Disclosure from public health: HIPAA and/or state/ local law
- Disclosure to schools: HIPAA and state/ local law
- Disclosure from schools: FERPA

## Disclosures to Public Health

## HIPAA: Disclosure by Covered Entities 

- Providers (CE) who transmit PHI electronically
- must obtain written authorization for disclosures
- of PHI _EXCEPT:_
- For treatment, payment or health care operations (TPO)
- To individual
- Exceptions specifically listed in rule
- Includes public health

## Disclosure To Public Health (1)

- Providers may disclose PHI to public health authorities _without authorization_:
- If reporting is required by law (45 CFR §164.512(a)(1)) **and/or**
- For certain public health activities and purposes (45 CFR §164.512(b)(1)(i))
- Other specified purposes
- Specific mandate to report not required
- State and local laws still apply
- E.g. registry law requires consent

## Disclosure To Public Health (2)

- Provider may disclose PHI for activities
- and purposes to:
- 	“...a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease,....the conduct of public health surveillance, public health investigations, and public health interventions...” (45 CFR §164.512(b)(1)(i))

## Public Health Authority

- Public health authority means:
- an agent or authority of the US, a State, a territory, a political subdivision of a State or territory, or an Indian tribe,
- or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency, or its contractors or persons or entities to whom it has granted authority,
- that is responsible for public health mandates as part of its official mandate (45 CFR §164.501)

## Other HIPAA Disclosure Requirements 

- CE must:
- disclose minimum amount of information necessary to achieve intended purpose
- Does not apply to disclosures for treatment or to individual
- keep track of disclosures to non CE
- provide accounting of disclosures if requested

## Disclosure from Public Health

## Disclosure From Public Health

- Depends on whether individual entity is a CE
- Doctors, nurses, and other providers of direct service in state and local health departments may be CE if they transmit PHI electronically
- Payers (e.g. Medicaid) are CE if they transmit PHI electronically
- CE must comply with Privacy Rule
- Privacy Rule does not govern use and disclosure of information by non CE
- State and local laws still apply

## Status of Public Health Entities Under HIPAA

- Depending on legal structure and policy decisions, a public health entity may be:
- Non covered entity
- Hybrid entity
- Covered entity
- Status of entity impacts disclosure of information from public health
- Whether or not HIPAA governs disclosure

## HIPAA Implementation Decisions Impacting Public Health 

- Many legal entities (e.g. state DHHS) perform:
- Covered functions (e.g. direct service, payment) and
- Non-covered functions (e.g. registries, surveillance, licensing)
- Legal entity with covered and non-covered functions can:
- Choose to be a hybrid entity _OR_
- Entire legal entity can function as CE
- Decision may depend on how entity is structured
- Legal entity may not perform covered functions and not be CE

## Hybrid Entity

- Hybrid entity means a single legal entity
- That is a CE
- Whose business activities include both covered and non-covered functions; and
- That designates health care components...(45 CFR §164.504)
- Health care components must comply with appropriate provisions of Privacy Rule
- Non health care components not required to comply with most provisions
- CE that does not designate health care components, is subject to Privacy Rule in entirety

## Why not become a hybrid?

- Hybrid entities must create adequate separation (e.g. firewalls) between health care components and other components
- Transfer of PHI by health care component to non health care component is disclosure
- Health care components must keep track of disclosures

## What if an entire legal entity decides to function as a CE? (1)

- CEs can exchange information without authorization for TPO and coordination of benefits
- Covered functions (e.g. direct service) will have to comply with Rule (e.g. privacy notice to patients)

## What if an entire legal entity decides to function as a CE? (2)

- Programs or services that would not traditionally be considered covered (e.g. registries) will have to comply with applicable provisions of Rule for use and disclosure of PHI
- Need authorization unless disclosure is for TPO, to individual, an exception, or authorized by state law
- Must track disclosures

## Disclosure to Schools

## Disclosure to Schools (1)

- Schools are not traditional public health authorities
- HIPAA compliant authorization _may_ be required for CE to disclose to schools
- Analysis includes:
- Purpose of disclosure: for treatment or to verify immunization status
- If disclosure is for treatment purposes (e.g. school nurse administers shot), authorization should not be required

## Disclosure to Schools (2)

- Analysis (cont.)
- State public health laws
- HIPAA does not preempt state public health laws that provide for the “...conduct of public health surveillance, investigation, or intervention.” 45 CFR 160.203(a)(2)(c)
- Public health laws allowing providers to share immunization information with schools should not be preempted
- Check with legal counsel
- If authorization is required, authorization must be HIPAA compliant

## HIPAA Authorization Requirements

- Authorization must include:
- Description of information requested
- Names/ class persons authorized to make request
- Specific people/ class persons to whom CE must disclose
- Purpose for which information may be used or disclosed
- Expiration date
- Signature and date
- Notice of individual’s rights in regard to authorization
-     (45 CFR §164.508(a)(3)(c)(1))

## Disclosure to Schools: Another Interpretation 

- School _may_ be considered public health authority for limited purpose, to extent that it is authorized to collect or receive information for public health purposes, e.g. to comply with school immunization laws
- Authorization _may not_ be required
- Consistent with intent of Rule
- Check with your legal counsel
- In absence of legal opinion supporting interpretation, use authorization

## Disclosure from Schools

## Disclosure From Schools (1)

- FERPA requires parental consent (or consent of child over 18) to disclose almost all information from education record
- Includes immunization information
- HIPAA Privacy Rule does not impact the transfer of this information

## Disclosure From Schools (2)

- Schools may disclose directory information without consent
- Includes student’s name, address, telephone #, date and place of birth, honors and awards, dates of attendance
- Must allow parents and eligible students a reasonable amount of time to request that school not disclose directory information

## Additional Considerations 

- School nurses _may_ be CE if they:
- Transmit health information (from outside education record) electronically in connection with HIPAA transactions
- Are employed by a CE who transmits PHI (from outside education record) electronically in connection with HIPAA transactions
- School-based clinics _may_ be CE under HIPAA
- E.g. Nurse, employer, or clinic may file Medicaid claims electronically

## Laws Governing Health Information in Schools and School-based Health Clinics 

- IF health information is part of education record, it is subject to FERPA
- IF health information is not part of education record, and it is transmitted electronically in connection with a HIPAA transaction, it is subject to HIPAA and not subject to FERPA
- See FERPA References for detailed analysis by:
- Jill Moore and Aimee Wall
- KY School Board Association and KY Dept. Education

## Summary: Disclosure to Public Health Under HIPAA

- Providers (CE) can disclose PHI for public health purposes without authorization if the information is the minimum necessary to meet the intended purpose
- Specific mandate to report is not required
- State and local laws still apply
- Must track disclosures

## Summary: Disclosure from Public Health Under HIPAA

- Determine whether legal entity is a CE (seek legal counsel)
- Non CE are not bound by HIPAA
- State law governs
- If legal entity is a CE:
- Is it a hybrid? If so, determine if program is a health care component or non health care component
- If entire entity is a CE, If not, is disclosure to individual, for TPO, or allowed under exception? Does state law address disclosure?  Is an authorization required?

## Summary: Disclosure to and from Schools

- Since school is not traditional public health authority, HIPAA compliant authorization _may_ be required for CE to disclose to school
- Seek opinion of legal counsel based on analysis of state law and purpose of disclosure
- FERPA requires consent to disclose information from education record

## NCVHS Recommendations (1)

- National Committee on Vital and Health Statistics (NCVHS)  is Advisory Committee to Secretary HHS
- Subcommittee on Privacy and Confidentiality held hearings on:
- Impact of HIPAA on public health (11/03)
- Impact of HIPAA on schools (2/04)
- NCVHS letters to Secretary contain recommendations favorable to public health

## NCVHS Recommendations (2)

- NCVHS recommendations to Secretary include:
- “HHS should regard disclosure of immunization information to school as a public health disclosure, thereby permitting providers to disclose this information to appropriate school officials without an authorization.”
- (NCVHS letters to Secretary Thompson, 6/17/04
- and 3/5/04)

## For More HIPAA Information:CDC Resources

- CDC/ ATSDR Privacy Rule Homepage:   _[http://www.cdc.gov/privacyrule](http://www.cdc.gov/privacyrule)_
- Can submit questions
- MMWR: HIPAA Privacy Rule and Public Health _[http://www.cdc.gov/privacyrule/Guidance/PRmmwrguidance.pdf](http://www.cdc.gov/privacyrule/Guidance/PRmmwrguidance.pdf)__ _
- National Immunization Program website:  _[http://www.cdc.gov/nip/registry](http://www.cdc.gov/nip/registry)_
- Click on Privacy, Confidentiality, Security & Legislation

## For More HIPAA Information:Office for Civil Rights

- OCR website: _[http://www.hhs.gov/ocr/hipaa](http://www.hhs.gov/ocr/hipaa)_
- FAQs address relevant issues including reminder/recall

## For More HIPAA Information:NCVHS

- NCVHS website: _[http://www.ncvhs.hhs.gov](http://www.ncvhs.hhs.gov/)__ _
- Click on Reports and Recommendations
- Letters dated 6/17/04 and 3/5/04
- Click on Transcripts and Minutes for testimony from hearings
- Subcommittee on Privacy and Confidentiality hearings on 2/19/04 and 11/19/03

## For More Information: FERPA and HIPAA (1)

- US Department of Education website: _[http://](http://www.ed.gov/policy/gen/guid/fcpo/ferpa/index.html)__[www.ed.gov/policy/gen/guid/fcpo/ferpa/index.html](http://www.ed.gov/policy/gen/guid/fcpo/ferpa/index.html)_
- Applicability of HIPAA to Health Information in Schools (Jill Moore and Amy Wall, UNC School of Government) _[http://](http://www.medicalprivacy.unc.edu/pdfs/schools.pdf)__[www.medicalprivacy.unc.edu/pdfs/schools.pdf](http://www.medicalprivacy.unc.edu/pdfs/schools.pdf)_

## For More Information: FERPA and HIPAA (2)

- Advisory Statement on Local School Districts’ Responsibilities Under HIPAA (KY School Boards Association and KY Dept. of Education) _[http://www.ksba.org/legalhipaa.htm](http://www.ksba.org/legalhipaa.htm)__ _
- Includes model authorization form

## Contact Information

- Gail Horlick, M.S.W., J.D.
- Public Health Analyst
- CDC National Immunization Program
- 1600 Clifton Rd. NE, MS E-52
- Atlanta, Ga. 30333
- phone: 404-639-8345
- fax: 404-639-8627
- email: gyh6@cdc.gov