Documents and

Committee Reports

The Model State Health

Statistics Act

A Model State Law for the

Collection,Sharing, and Confidentiality

of Health Statistics

D HEW 7%blication No. (PHS) 80-1458

U.S. DEPARTMENT OF HEALTH, EDUCATION, AND WELFARE

Public Health Service

Office of Research, Statistics, and Technology

National Center for Health Statistics

Hyattsville, Md. March 1980

Series4

Number 21
NATIONAL CENTER FOR HEALTH STATISTICS

DOROTHY P. RICE, Director

ROBERT A. ISRAEL, Depu ty Director

JACOB J, FELDMAN, Ph.D., Associate DirectorforAna~sis

GAIL F. FISHER, Ph.D., Associate Director for the Cooperative Heah?z Statistics System

ROBERT A. ISRAEL, Acting Associate Director for Data Systems

ROBERT M. THORNER, SC.D., Acting Associate .Directorfor hzterncztiona~ Statistics

ROBERT C. HUBER, Associate Director for Management

MONROE G, SIRKEN, Ph.D., Associate Director for Mathematical Statistics

PETER L. HURLEY, Associate Directorfor Operations

JAMES M. ROBEY, Ph.D., Associate Director for Program Development

PAUL E. LEAVERTON, Ph. D., Associate Director for Research

ALICE HAYWOOD, Information Officer ~

Vital and Health Statistics-Series 4-No. 21

DHEW Publication No. (PHS) 80-1458

Library of Congress Cutalog Curd Number 79-16430
PREFACE

The Model State Health Statistics Act is designed to be used by State legislators in developing laws for collecting, sharing, and protecting the confidentiality

of health statistics. State legislators and State health officers are increasingly

finding

(1)

(2)

(3)

that:

An effective health care system is dependent on the availability of accurate and timely health data.

The cent’identiahty of data Identifying individuals must be assured in order

to encourage the voluntary provision of such data.

The sharing of health data by appropriate agencies within and among

States and the Federal Government is of mutual advantage and necessary

to determine the status of the health care system and evaluate its operation.

The purpose of the Model State Health Statistics Act, therefore, is to authorize

through legislation an agency in the State to collect and maintain accurate health

data, protect health data from unwarranted disclosure, share health data for purposes consistent with those for which they were collected, and coordinate heaJth

data activities in the State to eliminate unnecessary duplication of data collection

and to maximize the usefulness of data collected.

The Act also recognizes the importance of and provides for State participation

in the Cooperative Health Statistics System, a cooperative system for producing

comparable health statistics at the national, State, and local levels.

This Act does not apply to vital statistics. Each State has already established

a vital statistics agency. The National Center for Health Statistics developed in

1977 a revision of the ModeI State Vital Statistics Act for use by State legislators

in revision of existing vital statistics acts. Although the Model State Health Statistics Act and the ModeI State Vital Statistics Act are designed as separate pieces of

legislation, consideration should be given to designating one agency to carry out

the purposes of both acts.

The Model State Health Statistics Act is the end product of a process which

began in 1975, Based on principles formulated by the Cooperative Health Statistics

Advisory Committee, a panel of State and Federal experts on statistics, confidentiality, and legislation drafted the Model State Health Statistics Act. The U.S.

National Committee on Vital and Health Statistics endorsed the Model Act and

urged its promulgation and wide distribution by the Secretary of Health, Education, and Welfare. The Council of State Governments included the Model Act in

...

Ill
its publication 1979 Suggested State Le@Nation. The 1978 Governing Council of

the American Public Health Association also recommended its enactment by State

governments.

The responsibility for the development of the Model State Health Statistics

Act was-that of Mr. GarrieJ. Losee, Deputy Director, Division of the Cooperative

Health Statistics System. Valuable assistance and advice were provided by a number of persons, but particularly by Isabel P. Dunst, Associate General Counsel,

Office of the General Counsel, Department of Health, Education, and Welfare.
ACKNOWLEDGMENTS

The commentary presented in this report is based primarily on the work of

Moshman Associates, Inc., in cooperation with John J. Cohrssen, Private Consultant, under contract number 233-78-2107 with the National Center for Health

Statistics. The principles contained in the Model State Health Statistics Act and

much of its content were developed by a panel of experts convened and supported

by Moshman Associates, Inc., under contract number HRA 230-76-0288. Mr.

Howard West was the Project Director for both of these contracts. The contributions of the members of the Expert Panel, Mr. Cohrssen, Mr. West, Dr. Moshman,

and other staff of Moshman Associates, Inc., are gratefully acknowledged.

,V
EXPERT PANEL FOR THE DEVELOPMENT OF THE

MODEL STATE HEALTH STATISTICS ACT

MEMBERS

Larry Carries

Staff Director

Florida Senate Health Committee

Donald Davids

Director

Health Statistics and

Vital Records Division

Colorado Department of Health

Robert Derbyshire, M.D.

Secretary-Treasurer

New Mexico Board of Examiners

Joseph Duncan, Ph.D.

Deputy Associate Director for

Statistical Policy

Office of Management and Budget

Joel Edelman

Executive Secretary

Illinois Legislative Advisory Committee

on PubIic Aid

John P. Fanning

Office of the Assistant

Secretary for Health

Department of Health, Education,

and Welfare

John Fitzgerald

Office of Legal Counsel

Tennessee Deaprtment of Health

Eugene W. Fowinkle, M.D.

Commissioner

Tennessee Department of Health

Paul Gunderson, Ph.D.

Director

Center of Health Statistics

Minnesota Department of Health

Vito Logrillo

Director of Health Statistics

New York State Department of Health

Tarky Lombardi

New York State Senator

Walt R. Simmons

Consultant to the National Center

for Health Statistics on Issues

Regarding Confidentiality of Data

in the Cooperative Health Statistics

System

George Tipp

Member

Advisory Committee on the

Cooperative Health Statistics

System

WiIIisWare, Ph.D.

Vice Chairman

Privacy Protection Study

Commission

vi
RESOURCE STAFF

John J. Cohrssen, Private Consultant

Attorney at Law

Washington, D.C,

Isabel P. Dunst

Associate General Counsel

Office of the General Counsel

Department of Health, Education,

and Welfare

Garrie J. Losee

Deputy Director

Division of the Cooperative Health

Statistics System

National Center for Health Statistics

Robert H. Mugge, Ph.D.

Assistant to the Director

Office of the Center Director

National Center for Health Statistics

William F. Stewart

Deputy Associate Director

Office of Program Development

National Center for Health Statistics

Howard West

Project Director

Contract No. HRA 230-76-0288

Moshman Associates, Inc.

vii
THE MODEL STATE HEALTH STATISTICS ACT

Section 1. [Sho~t Title.] This Act may be cited as

the (State) Health Statistics Act.

Section 2. [Definitions. ] As used in this Act:

(1) “Agency” means the agency designated to

carry out the purposes of this Act.,

(2) “Disclosure” means the communication of

health data to any individual or organization outside the

Agency.

(3) “Health data” means any information, except vital statistics as defined in (appropriate State

statute), relating to the heaith status of people, the availability of health resources and services, and the use and

cost of such resources and services.

(4) “Identifiable health data” means any item,

collection, or grouping of health data which makes the

individual supplying it or described in it identifiable;

(5) “Individual” means a natural person.

(6) “Organization” means any corporation,

association, partnership, agency, department, unit, or

other legally constituted institution or entity, or part

thereof.

(7) “Research and statistical pu~oses” means

the performance of certain activities relating to health

data, including, but not limited to: (i) describing the

group characteristics of individuals or organizations; (ii)

analyzing the interrelationships among the various characteristics of individuals or organizations; (iii) the conduct of statistical procedures or studies to improve the

quality of health data; (iv) the design of sample surveys

and the selection of samples of individuals or organizations; (v) the preparation and publication of reports describing these matters; and (vi) other related functions.

Specifically excluded is the use of the data for an individual or organization to make any determination directly

affecting the rights, benefits, or entitlements of that individual or organization.

NOTE: Where the need for variationwas apparent,parentheses,”( ),” havebeen used.

In uses where recommendationswere considered optional,

word~gw= placed ~ b~ckets, ”[ 1.“

Section 3. [Organization. ] The (appropriate State

Agency) is hereby designated as the Agency to carry out

the purposes of this Act.

Section 4. [Agency Authority.]

(a) In carrying out the purposes of the Act, the

Agency may:

(1) Collect and maintain health data on:

(i) The extent, nature, and impact of illness

and disability on the population of the State.

(ii) The determinants of health and health

hazards.

(iii) Heaith resources, including the extent

of available manpower and resources.

(iv) Utilization of health care.

(v) Heaith care costs and financing.

(vi) Other health or health-related matters.

(2) Undertake and support research, demonstrations, and evaluations respecting new or improved methods for obtaining current data on the matters referred to

in Section 4(a)(l).

(b) The Agency may collect health data under other

authorities and on behalf of other governmental or notfor-profit organizations.

(c) The Agency shall collect data only on a voluntary

basis from individuals and organizations, except when

there is specific legal authority to compel the mandatory

reporting of the health data so re@ested. In making any

collection of health data from an individual or organization, the Agency must give to that individual or organization a written statement which states:

(1) Whether the individual or organization is

required to respond, and any sanctions for noncompliance.

(2) The purposes for which the health data are

being collected,

(3) In the case of any disclosure of identifiable

health data for other than research and statistical purposes, the items to be disclosed, to whom the data are to

be disclosed, and for what purposes,

(d) Except as provided in Section 5, no health data

obtained in the course of activities undertaken or supported under this Act may be used for any purpose other

viii
than the purpose for which they were supplied or for

which the individual or organization described in the data

has otherwise consented.

(e) The Agency shall (1) take such actions as may

be necessary to assure that statistics developed under

this Act are of high quality, timely, and comprehensive,

as well as specific, standardized, and adequately analyzed

and indexed; and (2) publish, make available, and disseminate such statistics on aswide abasis as practicable.

(f) The Agency shall take such action as is appropriate to effect the coordination of health data activities

within the State to eliminate unnecessary duplication of

data collection and maximize the usefulness of data colIegted,

(g) The Agency shall (I) participate with State, 10-

cal, and Federal agencies in the design and implementation of the Cooperative Health Statistics System, a system

for producing comparable and uniform health information and statistics at tie Federal, State, and local levels;

(2) undertake and support research, development, demonstrations, and evaluations respecting such cooperative

system; and (3) provide the (State) share of the data collection costs under such system.

Section 5. [Disclosure of Identtj$able Health Data. ]

(a) The Agency may make no disclosure of any item,

collection, or grouping of hezltb “data which makes the

individual supplying it or described in it identifiable

unless:

(1) The individual described in the data has

consented to the disclosure.

(2) The disclosure is to a governmental entity

in this State, in another State, or the Federal Government,

provided that: (i) the data will be used for a purpose for

which the data were collected by the Agency, and (ii)

the recipient of the data has entered into a written agreement satisfactory to the Agency that it will protect such

data in accordance with the requirements of this Act and

will not permit further disclosure without prior approval

of the Agency.

(3) The disclosure is to an individual or organization, for a specified time period determined by the

Agency, solely for bona fide research and statistical purposes, as determined in accordance with guidelines

adopted by the Agency, and the Agency determines that:

(i) the disclosure of the data to the requesting individual

or organization is required for the research and statistical

purposes proposed, and (ii) the requesting individual or

organization has entered into a written agreement satisfactory to the Agency that it will protect such data in

accordance with the requirements of this Act and will

not permit further disclosure without prior approval of

the Agency. In no event, however, may the name, address, or other unique personaJ identifier of an individual

supplying the data or described in them be disclosed

under this paragraph to the requesting individual or

organization.

(4) The disclosure is to a governmental entity

for the purpose of conducting an audit, evaluation, or

investigation of the Agency and such governmental entity

agrees not to use those data for making any determination affecting the rights, benefits, or entitlements of any

individual to”whom the health data relate.

(b) Any disclosure provided for in Section 5(a) shall

be made at the discretion of the Agency, except that the

disclosure provided for in Section 5(a)(4) must be made

when the requirements of that paragraph have been met.

(c) No identifiable health data obtained in the course

of activities undertaken or supported under this Act shall

be subject to subpoena or similar compulsory process in

any civil or criminal, judicial, administrative, or legislative

proceeding, nor shall any individual or organization with

lawful access to identifiable health data under the provisions of this Act be compelled to testify with regard to

such health data, except that data pertaining to a party

in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of

such individual to enforce any liability arising under this

Act.

Section 6. [Security of Health Data. ] The Agency

shall take appropriate measures to protect the security

of health data, including:

(1) Limiting the “access to health data to authorized individuals who have received training in the

handling of such data.

(2) Designating a person to be responsible for

physical security.

(3) Developing and implementing a system for

monitoring security.

(4) Reviewing periodically all health data to

evaluate whether it is appropriate to remove identifying

characteristics from the data.

(5) Developing a program for the destruction,

on a routine scheduled basis, of all forms, records, or

magnetic tape files maintained by the Agency which

contain information identifying individuals or individual

organizations.

Section 7. [General Powers. ] h addition to any

other powers authorized by law, in accordance with

State law, the Agency shall have the authority to (1)

make and enter into contracts to purchase services and

supplies and hire consultants; (2) develop and submit

a proposed budget; (3) accept. gifts and charitable contributions; (4) apply for, receive, and expend grants; (5)

promulgate regulations appropriate to the effective implementation of this Act; (6) establish charges for and

collect payment from individuals and organizations for

the provision of services, including data dissemination;

(7) receive and expend appropriations; (8) enter into a

reimbursable work program with other agencies of the

State or private agencies under which funds are transferred from such other agencies to this Agency for the

performance of activities authorized under this Act;

[and] (9) establish and compensate members of advisory

boards &bject to any State law limiting compensation of

advisory board members; [(10) hire employees; (11)

aPPoint ZI’Iexecutive director; and ( 12) provide such other

services and perform such other functions as are necessary

to fulfill its responsibilities under this Act.]

ix
Section 8. [Criminal Penalties and Civil Remedies. ]

[(a) In addition to any other criminal penalties under the laws of this State, any individual or organization

that wiIIfully violates any provision in Section 5 or any

regulations implementing that section shall, upon conviction, be fined not more than $(0,000.00), or imprisoned

for not more than (00) months, or both. Such organizations shall be fined not more than $(0,000 .00).]

[(b) The Agency or an organization acting upon its

behalf shall be liable to an individual or organization injured by the intentional or negligent violation of any provisions of Section 5 in ah amount equal to the damages

sustained by the individual or organization, together with

the cost of the action and reasonable attorney’s fee as determined by the court.]

Section 9. [Appropriations. ] There is hereby authorized to be appropriated sufficient funds to meet the

purposes of this Act.

Section 10. [Severability. ] [Insert severability

clause. ]

Section 11. [Repeal. ] [Insert repealer clause.]

Section 12. [Effective Date. ] [Insert effective date.]

x
CONTENTS

Reface .o.......o.o.o.o.oo...........o....o.o..o........o..o...............o....o.oo.oo.oo ..................o...o..............o.........o.o...............

Acknowledpents ...................................................................................................................................

Expert Panel for the Development of the Model State Health Statistics Act.., ........................................

Member&...........................................................................................................................................

Resource Staff ,.................................................................................................................................

The Model State Health Statistics Act ..................................................................................................-

Purpose, Development, and Operation of the Model State Health Statistics Act ....................................

Purpose and Development ................................................................................................................

Basic Concept ....................................................................................................................................

Summary of Principal Features .........................................................................................................

Collection, Utilization, and Transmission Authority ....................................................................

Protection of Health Data ...........................................................................................................

Designation and Coordination .....................................................................................................

Optional Provisions ......o..o......oo.........o..o.o.......o...............o.................oo.....o.oo.o...o..o...o......o..........-

Section-by-Section ~dysis ....................................................................................................................

Legal Aspects of the Model State Health Statistics Act ..........................................................................

Federal Law ......................................................................................................................................

Authority ....................................................................................................................................

Confidentiality and Data Disclosure .............................................................................................

Organization... o...o..o.....oo...o.o..............o..o.o...................o........o.............o.............o.....4.....o....o.....o.o..

State bw ......a...................................................................................................................................

Appendixes

L Excerpts From Laws Pertinent to Health Statktics ...............................................................-

II. Rules and Regulations Concerning Confidentiality: Health Care Financing Administration...

III. NCHS Guidelines to Prevent Disclosures of Identifiable Data .................................................

... m

v

vi

vi

vii

viii

1

1

:

3

3

4

5

5

14

14

::

16

16

19

45

48

xi
THE MODEL STATE HEALTH STATISTICS ACT

A MODEL STATE LAW FOR THE COLLECTION, SHARING, AND

CONFIDENTIALITY OF HEALTH STATISTICS

PURPOSE, DEVELOPMENT, AND OPERATION OF THE

MODEL STATE HEALTH STATISTICS ACT

PURPOSE AND DEVELOPMENT

Heilth statistics are necessary for a variety of

activities related to the provision of health care,

including planning, evaluation, and research.

These statistics, important for States, localities,

and the Nation, are developed from various kinds

of health information and data collected by

States and localities. (See appendix I for excerpts

from laws pertinent to health statistics and appendix II for an example of pertinent rules and

regulations. )

The Model State Health Statistics Act

(MSHSA) is designed to remedy existing deficiencies in legal authority for health data collection and to specifically authorize State

participation in the Cooperative Health Statistics

System.

A concern with issues of confidentiality and

comparability of State and local health data

stimulated the activities which led to the creation

of the MSHSA. As States and the Federal Government began cooperative efforts for the development of health statistics, a need for expanding

State capacity became evident. The U.S. Congress

in section 306(d) of the Public Health Service

Act mandated the following:

“To insure comparability and reliability of

health statistics, the Secretary shall, through

the [National] Center [for Health Statistics] , provide adequate techniczd assistance

to assist State and local jurisdictions in the

development of model laws dealing with

issues of confidentiality and comparability

of data. ”

A review of the legal authority relating to

health statistics operations in a sample of 12

States, conducted under the auspices of the

National Center for Health Statistics (NCHS),

led to an overall compelling conclusion. The

necessary legal authority for the conduct of

activities basic to the development and sharing

of high-quality health statistics was lacking in

many States. States differed substantially in

legal and organizational structure. Often there

was a lack of specific authority to collect, maintain, or transmit health data and therefore

corresponding lack of authority to protect the

confidentiality of sensitive personal health data.

1
The absence of confidentiality protection was

seen as a barrier to the voluntary provision of

health data, particularly during a time when

States were enacting public record disclosure

laws and similar laws in reaction to fears about

government. secrecy. Moreover, this lack also

appeared to be a barrier to a State’s ability to

engage in cooperative health statistics efforts.

Thus new legal authority was necessary for

two purposes: First, to assure adequate confidentiality protection; second, to enable a State

to participate appropriately ’in cooperative efforts

among States and the Federal Government.

To meet these needs, a broadly participatory

process that relied strongly on State and local

expertise was undertaken to develop a model

law. First, the principles for a model law were

developed; these were presented to a national

meeting of involved State and 10CZ.Iofficials. Then

an expert panel was convened to draft the model

law. The panel included State officials representing both the executive and Ie&slative viewpoints

and experts in the fields of privacy, confidentiality,. and health statistics. During its refinement

process, drafts of the MSHSA were widely distributed for comment, and the MSHSA was

modified accordingly. The entire process covered

a 3-year period.

The development process focused on achieving a simple rather than complex model law. The

model law can be easily modified to meet the

particular needs of anindividual State. The model

contains those basic functions necessary to

adequately conduct health statistics in a State

and protect the confidentiality of individuals

identifiable in the data. Optional provisions

give a State additional flexibility. The statutory

authority to protect the confidentiality of individuals identifiable in the, data may well be

accomplished by a combination of existing State

law and MSHSA provisions.

The MSHSA establishes a system for the collection, transmission, use, and protection of

health data. A State may adopt all of the provisions in the MSHSA or only some, depending

on existing State law and the need for additional

legal authority. A State with complete authority

to carry out these activities would not need to

consider adopting the MSHSA. However, officials

in a State with no authority or only some of

these authorities should seriously consider enacting all or part of the model law to remedy

existing deficiencies. Clearly, a thorough analysis

of existing laws in each State is necessary for

officials to make an informed decision regarding

necessary legislative action.

It cannot be overemphasized that the design

of the MSHSA enables a State to select those

sections necessary to meet State needs and fit

them within the existing legal and organizational

structure. Officials in a State considering adoption of the MSHSA should remember that it is

flexible in two regards: (1) the basic and optional

sections to be adopted and (2) the exact language

of each section. Variations in State law, organization, and requirements dictate appropriate

modification of the MSHSA in each State.

The MSHSA specifically excludes consideration of vital records and vital statistics since each

State has adopted specific legislation for these

matters. Also, a recently drafted model act, the

Model State Vital Statistics Act, is currently

available to the States. While the MSHSA and the

Model State Vital Statistics Act are designed as

separate pieces of legislation, consideration

should be given to designating one agency to

carry out the purposes of both acts, particularly

since vital statistics and health statisticsare both

components of the Cooperative Health Statistics

System.

BASIC CONCEPT

The fundamental principle underlying the

MSHSA is that each State has a need to develop

and have available accurate health-related data

and to share certain health-related data among

appropriate agencies in the State, other States,

and the Federal Government. The sharing of

data for health planning and research and statistical purposes is mutualIy”advantageous and necessary for detegnining the health status of the

people, the status and use of the health care

system, and the effect of the system on health

resources and services.

The MSHSA provides legal authority for a

State organization to collect, use, and share data

and at the same time to protect the confidentiality of individuals identifiable in the data, These

functions are best achieved if they are all the
responsibility of a single focal organization. The

MSHSA offers the necessary organizational

structure to meet these requirements. The character and designation of the focal organization,

its location within the State government, and its

relationship with corresponding Federal, State,

and nonpublic organizations must be tailored to

meet the unique requirements of a State. Moreover, many States may not need a new organization if they currently have one or more appropriate organizational structures which can be or

may have been designated to perform the basic

functions in the MSHSA.

The MSHSA recognizes and builds on the

premise that afocal statistical agency at the State

level will usually have the responsibility for collecting both general-purpose baseline statistical

information and programmatic data for Stateoperated health programs. The MSHSA authorizes the Agency to collect baseline data, but

only on a voluntary basis and in the absence of

either authorizing legislation. The MSHSA also

provides for the collection of programmatic

data by the Agency both for itseIf under separate legal authority and on behalf of other

organizational entities. Collections requiring

mandatory reporting of health data may be

required by separate legislation.

Provision of health information is voluntary,

Confidentiality protection must be afforded individual providers and recipients of health care

who could be identified in the data; otherwise,

they might be reluctant to provide personal information, The MSHSA is designed to give such

protection. It severely restricts the transfer of

health data in which individuals are identifiable

to those situations in which confidentiality will

be maintained by the recipient.

While the Agency’s primary function is to

collect health data for itself, it is anticipated that

an entity within the State which is competent

to collect health data will serve in this capacity

for other entities, Thus the Agency will have the

authority to collect data or conduct statistical

analyses for other organizational entities.

SUMMARY OF PRINCIPAL FEATURES

The MSHSA balances “society’s need to

know” and “the individual’s right to privacy.”

It protects the privacy of the data subject and

makes identifiable health data confidential, thus

reassuring the individual and the public at large.

At the same time, the MSHSA provides a State

with the legal authority to accomplish necessary

activities related to health statistics within the

State and to participate in the Cooperative

Health Statistics System both within and outside the State.

Collection, Utilization, and Transmission

Authority

The Agency referred to in the MSHSA has

specifically described authority to collect, maintain, and utilize health data on a broad range of

activities that relate to health. Moreover, the

Agency is given authority to participate in cooperative efforts among States and with the

Federal Government and has corresponding

authority to support and undertake research to

improve methods of health data collection and

development of statistics.

The Act requires that the respondent be

told during the collection process whether his

response is voluntary or required; the purposes

for which the health data are being collected;

and what ;tems will be disclosed, to whom, and

for what purposes. This information gives the

supplier of health data the basis for an informed

decision on whether or not to respond.

The Agency is given broad authority for

utilizing health data to generate health statistics.

The Agency may transmit confidential health

data to another organization in the State, in

another State, or in the Federal Government but

only when that other organization has the authority to maintain the confidentiality of the

health data.

Protection of Health Data

Health data obtained in the course of activities undertaken or supported by the MSHSA are

protected in two ways. First, the data may be

used only for the purposes for which they were

supplied or for purposes to which the individual

or organization described in the data later consented. For example, data collected from a hospital for statistical purposes only could not be

used for ratesetting, a nonstatistical purpose,

3
without obtaining consent from the hospital.

This important limitation on data use applies to

the Agency itself as well as any other recipient

of the data.

The second way that the data are protected

is in limitations placed on the disclosure, or release, of the health data. (This second protection

is not extended to facility data. ) The Agency is

specifically directed to publish or otherwise release statistics, or aggregated health data, on as

wide a basis as practicable. However, it may not

release health data in which the individuals

supplying the data or described in them are identifiable urdess the release is one of only four permissible exceptions to the rule.

The Agency may publish, transmit, or otherwise disclose health data in which ‘individuals

are identifiable if such disclosure was consented

to by the individuals. Consent may be provided

in one of two ways. First, the respondent must

be given at the time of collection a written statement of any intended disclosures, to whom they

would be made, and the purposes of such disclosures. With this knowledge, the respondent effectively grants informed consent by supplying the

requested data. An example would be a physician

who knowingly gives personal data to be included

in a directory of medical specialists. Health data

in which individuals are identifiable may also be

disclosed if the individuals give written consent

to such disclosure after the data have been collected.

The Agency may transmit health data in

. which an individual is identifiable to a government entity if the data are to be used only for

the intended purpose and if the government

entity agrees to protect the health data from

further disclosure and has authority for protecting the confidentiality of the health data

similar to that of the Agency. Additional exceptions are provided for research purposes under

conditions like those mentioned above and for

certain audit, evaluation, or investigative purposes that would not allow disclosure of the

health data.

The Agency has an obligation to protect the

confidentiality of health data by adopting appropriate security measures. Moreover, violations of

the confidentiality protection could result in

criminal penalties for improper disclosure.

This protection of health data through restrictions on disclosure relates only to health

data in which individuals are identifiable. Health

data in which individuals are not identifiable,

either data on organizations or aggregated data

on individuals, must be released on public inquiry

when under public record disclosure (“sunshine”)

laws.

Designation and Coordination

The MSHSA requires the designation of an

agency to carry out the functions described in

the Act and coordinate, as appropriate, all related data activities within the State. This important coordination authority helps assure that all

data and statistics within a State are of high

quality, that the costs of statistical activities are

minimized by elimination of unnecessary duplication, and that the usefulness of collected data

is maximized. While the Act was drafted based

on the assumption that a single agency would

perform all these functions, a State could conceivably share some of these functions among

severaI agencies, both governmental and private

nonprofit.

An important function of the Agency will be

to represent the State within the Cooperative

Health Statistics ~ystem (CHSS). CHSS is the

Nation’s shared health data system presently

being developed by local, State, and Federal

users and producers of health data. CHSS permits

health data to be collected once and shared

among all users. The Federal role in this system

is provided by the National Center for Health

Statistics, which is authorized to provide the

FederaI leadership for development of the

system. CHSS is designed to enable States and

localities to develop the resources and technical

expertise for data collection and the production

of statistics. CHSS incorporates several principles.

First, good health data can best be assembled

by properly trained and experienced personnel

at the State and local levels. Second, the data, if

standardized, can serve multiple users, thereby

conserving resources and avoiding unnecessary

duplication. Third, the Federal Government’s

role should be to encourage and support State

and local organizations to perform the functions

related to the collection and processing of health

4
data rather than performing these functions itself. Federal law requires that States participating

in CHSS designate a State agency to administer

or be responsible for the administration of CHSS

statistical activity in the State.

A number of other organizations are now involved in the collection and use of health data

and statistics, among which are Health Systems

Agencies (HSA’S), State Health Planning and

Development Agencies (SHPDA’S), and Professional Standards Review Organizations (PSRO’S).

Federal legislation and regulations for these

three programs anticipate data sharing among

them, However, sharing of data raises concerns

about the protection of confidential health data.

For the most part, PSRO’S adhere to restrictions

on disclosure of identifiable health data similar

to those contained in the MSHSA, while HSA’S

and SHPDA’S are required to open their records

to the public.

Optional Provisions

The MSHSA specifies an identified focal

point, the Agency. It can be an existing State

agency or a newly created one. As an optional

arrangement, a State may choose to have a nongovernmental organization designated. For example, a data consortium could serve as the “State

Agency or it could provide certain functions for

the designated State Agency through a contract

or other mechanism. These particular arrangements would need to be specifically detailed in

the appropriate MSHSA section and would need

to be permitted under State law.

The MSHSA does not afford confidentiality

protection to facilities, but a State may have reasons to do so. In this event, appropriate modification of the definition of confidentiality would

be necessary. Similarly, a State may seek to have

a much more narrow definition of confidentiality

and restrict disclosure only of specific types of

health data on individuals. Again, an appropriate

modification to the definition and other operative sections of the MSHSA would be necessary.

Also, a State may seek to have broader authority

for providing data to a bona fide research or statistical organization and may, in fact, prefer to

allow transmission of unique personal identifiers

to such an organization for the purposes of followup or follow-back studies.

SECTION-BY-SECTION ANALYSIS

In this discussion the exact language of each

part of the MSHSA is given in smaller type and

is followed by analysis and commentary.

Section 1. [Sho?t Title.] This Act may be cited as

tile (State) Health Statistics Act.

The title “State Health Statistics Act” was

specifically chosen to both indicate the focus of

the Act and to distinguish this Act from the existing vital statistics act of the State.

Section 2. [Definitions. ] As used in this Act:

Most definitions are self-explanatory and

correspond to the usual meaning of the word or

phrase. However, some aspects of the definitions

deserve special mention.

(1) “Agency” means the agency designated to

carry out the purposes of this Act.

“Agency “ is defined to mean the specific

organization designated to be responsible for

health data and health statistics within the State.

It is intended that a State government or an

appropriate nonprofit organization be so designated. The designers of the Act anticipate that

in some States the designated Agency may satisfy

certain functions of the Act through the efforts

of another State or nonprofit organization.

(2) “Disclosure” means the communication of

health data to any individual or organ?~ation outside the

Agency.

5
“Communication” means transmission or

conveyance in any form-written, oral, or otherwise. Communication within the Agency is not

considered a disclosure. The Act prohibits disclosure of identifiable health data collected or

supported under this Act except under the conditions described in the Act. (See definition of

“identifiable health data.”) Thus the Act protects

the confidentiality of identifiable health data,

but permits access under certain controllable

conditions. Such control would be lost if the

Agency were a SHPDA, which cannot protect

identifiable health data from disclosure.

(3) “Health data” means any information, except vital statistics as defined in (appropriate State

statute), relating to the health status of people, the availabilityy of health resources and services, and the use and

cost of such resources and services,

“Health data” is broadly defined to include

all forms of health-related information except

vital records and vital statistics. Vital records

and vital statistics have been excluded since State

legislation and policies regarding these already

exist in every State. In preparing for legislative

action on the Act, each State should review its

vital statistics act. Amendments to existing statutes may be needed to insure proper compatibility and accommodation with this Act. The

definition of vital statistics is to be incorporated

in the Act by citing the vital statistics act of the

State.

The definition of health data is intended

to include information on the extent and nature

of illness, disability, and other aspects of wellbeing; environmental, social, and other health

hazards; determinants of health; health resources,

including physicians, dentists, nurses, and other

health professionals by specialty and type of

practice; institutions, such as hospitals, extended

care facilities, and mental health institutions;

utilization of health care, including utilization

of ambulatory health services according to the

specialties and types of practice of the health

professionals providing such services, and the

services of hospitals, extended care facilities,

home health agencies, and other institutions;

and health care costs and financing, including

trends in health care prices and costs.

(4) “Identifiable health data” means any item,

collection, or grouping of health data which makes the

individual supplying it or described in it identifiable.

Under this definition only information identifying an individual receives confidentiality protection; information identifying only an institution is not afforded similar protection. A State

could, however, elect to include data identifying

health care facilities in the protection. Facilities

have not been afforded confidentiality treatment

in this Act because there appeared to be a greater

public interest in the availability of such information and less concern for the confidentiality

of facility data than data identifying individuals.

Also, facility data have not been granted confidentiality protection under some State licensing

laws and under comparable Federal health data

laws.

Under certain situations facility data could

reveal the identity of an individual. For example,

it might be possible to identify a particular surgeon from a table showing distributions of surgical procedures in hospitals in the State. Accordingly, such facility data would need to be characterized as identifiable health data.

The definition of identifiable health data

does not provide a standard as to when information is in fact identifiable. It is suggested that

the Agency established by this Act consider use

of the standard “potentially recognizable” to

provide a broad scope of confidentiality protection. The “potentially recognizable” standard

protects against disclosure of aggregated data on

small numbers of individuals from which identification of an individual could be made, If this

standard were used, the Agency would closely

scrutinize any intended release of health data to

determine if any individuals could be identified

through a combination of attributes. If so, the

data would be further aggregated to insure confidentiality protection. While the standard for

determining when a particular data item is identifiable must be general in character, it is anticipated that each State will provide greater content

to the definition through explanatory re@ations

and guidelines. (See appendix III”for comparable

guidelines used by NCHS.)

(5) “Individud” means a natural person,

6
This definition includes only natural persons,

alive or deceased. It is not intended to include

corporations.

(6) “Organization” means any corporation,

association, partnership, agency, department, unit, or

other legally constituted institution or entity, or part

thereof,

The definition of “organization” includes

hospitals, nursing homes, other health care

facilities, groups of physicians, and corporate

persons.

(7) “Research and statistical purposes” means

the performance of certain activities relating to health

data, including, but not limited to: (i) describing the

group characteristics of individuals or organizations; (ii)

analyzing the interrelationshipsamong the various characteristics of individuals or organizations; (iii) the conduct of statistical procedures or studies to improve the

quality of health data; (iv) the design of sample surveys

and the selection of samples of individuals or organizations; (v) the preparation and publication of reports describing these matters; and (vi) other related functions.

Specifically excluded is the use of the data for an individual or organization to make any determination directly

affecting the rights,benefits, or entitlements of that individual or organization.

The definition of “research and statistical

purposes” includes all descriptive and analytical

statistical activities relating to health. The listed

functions, subsections (i) through (vi), are a

basic characterization of likely Agency activities

but are not the only permissible activities. Subsection (vi), “other related functions,” is intended

to include various functions of a less usual nature

performed by a statistical agency, such as the

publication of lists and directories.

The definition specifically excludes any

activity conducted for the purpose of making

any determination directly relating to a specified

identifiable individual or organization and affecting the rights, benefits, or entitlements of

that individual or organization. It is designed to

distinguish research and statistical purposes from

regulatory or administrative use. Information on

a particular individual or organization obtained

solely for research and statistical purposes cannot

be used to determine particular characteristics of

any one individual or organization in order to

monitor compliance with statutes and regulations. Of course, identifiable health data obtained

for research and statistical purposes cannot be

used in making an administrative determination

affecting only an identifiable individual or organization. Thus the Agency is not permitted to

use health data relating to a particular identifiable

individual or organization and collected solely

under the authority of this Act in making a determination directly affecting the rights, benefits,

or entitlements of that individual or organization

in such actions as licensing, certification, registration, or other regulatory proceedings.

The prohibition against regulatory or administrative use does not extend to the use of aggregated data in the form of statistics prepared by

the Agency for formation of re~latory standards

adopted through legislation or rulemaking, even

though such standards might be applied subsequently against one of the individuals or organizations which originally submitted the data.

Indeed, research and statistical activities often

have regulatory consequences. A major goal of

such activities may be to effect changes in regulatory standards or criteria through legislative

modifications or administrative policymaking of

one type or another. Such activities, however,

must deal only with an entire class of activities,

individuals, or organizations.

Finally, the prohibition does not extend to

the granting of a specific benefit to a respondent

in a health survey. For example, compensation

to encourage participation in the survey would

be allowed.

Section 3. [Organization. ] The (appropriate State

Agency) is hereby designatedas the Agency to carry out

the purposes of this Act.

This section permits the designation of a

particular agency. Because of the substantial variation in organizational structure among the

States, as well as the close relationships between

research and statistical purposes and other activities involving health data, it is intended that the

greatest possible latitude be granted to States in

the designation of the Agency.

The Agency is to be the designated entity

identified in the Act. The Agency may be either

newly established or already in existence. It may

be limited to performing only the functions

authorized in the substantive provisions of the

7
Act, or it may have other functions pursuant to

other statutory authority, such as functions

related to vital records and vital statistics. However, there are advantages to the designation of

an Agency whose sole or primary function is the

collection of health-related data. The Agency

may also have specific mandatory data-collection

authority under other legislation. Accordingly,

the Agency or an organizational part thereof

could combine the functions described in the

Act with functions authorized under other legislation. The extent to which functions authorized

by other statutory authority are undertaken by

the Agency is appropriately left to the discretion

of the State.

In order to assure compliance with this Act,

provisions on the disclosure of identifiable health

data, and other restrictions, it is suggested that

the Agency have within the larger organization

a separable unit or office for the sole purpose of

administering the activities authorized by this

Act. Without a distinct separable unit, serious

questions could arise regarding which units were

authorized to collect, protect, and release data

under this Act and the relation of these authorities to other separately authorized functions of

the larger organization.

Nothing in the designation of the Agency is

intended to preclude the Agency from being a

nonprofit private orgtiization or from contracting with a private organization to perform the

functions authorized. In fact, in several States

data consortia are effectively performing the

types of functions envisioned for the Agency.

It is anticipated that in some States the Agency

will be a consortium or will seek to contract

with a consortium to continue providing data

services. The Agency may also rely on the participation of other State agencies or nonprofit

organizations to facilitate coordination of heahh

data activities within the State and ‘to participate

in the design and implementation of the Cooperative Health Statistics System.

Section4. [Agency Authority. ]

(a) In carrying out the purposes of the Act, the

Agency may:

(1) Collect and maintain health data on:

(i) The extent, nature, and impact of illness

and disability on the population of the State.

(ii) The determinants of health and health

hazards.

(iii) Health resources, including the extent

of available manpower and resources.

(iv) Utilization of health care.

(v) Health care costs and financing,

(vi) Other health or health-related matters.

(2) Undertake and support research, demonstrations, and evaluations respecting new or improved methods for obtaining current data on the matters referred to

in Section 4(a)(l).

Overall the Agency has been provided with

that authority thought best to facilitate the collection and utilization of high-quality health

data while promoting efficient use of public resources. The authority given the Agency reflects

the principles that:

1. Health data should be collected on a voluntary basis when it is to be used only for

research and statistical purposes; higher

quality data can be expected from voluntary data collection.

2. Identifiable health data cannot be disclosed

except under restricted conditions (as set

forth in section 5 of this Act) that are designed to safeguard the confidentiality of

identifiable information.

3. Health data which are not identifiable

should be fully shared.

4. The Agency should be able to provide

health data and related services to individuals and organizations outside of the

Agency.

Subsection (a) provides broad authority for the

Agency to collect and maintain data on the entire range of health and health-related matters.

Additionally, it is authorized to participate in research activities. Clearly the Agency would be

remiss in not performing zqmlyses designed to

improve and evaluate its operations, as well as

conducting research and demonstrations designed

to improve them.

(b) The Agency may collect health daVd under other

authorities and on behalf of other governmental or notfor-profit organizations.

The Agency is permitted to collect health

data under legzil authority other than that provided by this Act. For example, it could collect

data on the characteristics of health care facili8
ties under an authority to license such facilities.

It may also collect health data on behalf of

other government agencies or nonprofit organizations. It is anticipated that the Agency’s ability

to utilize its data-gathering sophistication on behalf of other organizations that want health data

will result in improved accuracy and timeliness

of health data in the State’ and more efficient

uses of resources. This authority, in effect, permits the Agency to serve as the principal health

statistics agency in the State by serving programmatic as well as general-purpose data needs.

(c) The Agency shall collect data only on a voluntary

basis from individuals and organizations, except when

there is specific legal authority to compel the mandatory

reporting of the health data so requested. In making any

collection of health data from ~.nindividual or organization, the Agency must give to that individual or organization a written statement which states:

(1) Whether the individual or organization is

required to respond, and any sanctions for noncompliance,

(2) The purposes for which the health data are

being collected.

(3) In the case of any disclosure of identifiable

health data for other than research and statistical purposes, the items to be disclosed, to whom the data are to

be disclosed, and for what purposes.

The Act provides the authority to collect data

only on a voluntary basis. Any other collections

must be based on authorities in other statutes.

Collecting data on a “voluntary basis” means

collecting data without the direct or implied

threat or imposition of any penalty or the withholding of any benefits from those who do not

cooperate. Whether the Agency should be provided broad, general-purpose authority under

the Act to collect data on a mandatory basis has

been a matter of considerable discussion, given

the data needs of the States as well as existing

practices in a number of jurisdictions. The experience of States and the National Center for

Health Statistics supports collection of health

data on a voluntary basis. Adequate data have

been collected on a voluntary basis with assurances that identifiable health data would be protected againstinappropriate disclosure. Moreover,

it was thought that some would perceive mandating health data collection for research and

statistical purposes as an unnecessary intrusion

into personal privacy. The drafters recognize,

however, that a State could conceivably wish to

enact mandatory data-collection authority for

specific well-defined purposes. While the experience of the States and Federal Government

recommends against broad mandatory authority,

speciaJ narrowly defined authority may serve a

useful function for a situation of special need.

The Agency’s use of such data, like its use of

data submitted voluntarily, is limited to the purposes for which the data were collected. This

subsection attempts to balance the needs of the

Agency to (1) assure confidentiality when acting

as a gatherer of health data on a voluntary basis

and (2) perform other functions it may have

under other authorities, such as collecting data

on a mandatory basis for administrative or regulatory purposes, either its own or those of other

agencies.

To clarify and emphasize these needs and

distinctions, the Agency is required to give suppliers of health data awritten statement designed

to insure that they are informed as to whether

or not they have to respond and are aware of the

purposes for which the health data are being collected and how the data may ultimately be used,

An individual or organization whose cooperation

is requested in a voluntary data collection will

have enough information to make an intelligent

decision as to whether or not to contribute certain information. Thus the act of voluntarily responding, with the appropriate knowledge of any

intended disclosure of identifiable data, explicitly provides evidence of informed consent to

such disclosure.

(d) Except as provided in Section 5, no health data

obtained in the course of activities undertaken or supported under this Act may be used for any purpose other

than the purpose for which they were supplied or for

which the individual or organization described in the data

has otherwise consented.

The restriction in subsection (d) applies only

to data collected under the voluntary authority

provided in this Act. It applies whether the data’

provided under the authority of the Act are on

behalf of the Agency itself or on behalf of another entity (subsection 4(b)). It does not apply

to data, such as vital statistics, collected under

other legal authority.

9
(e) The Agency shall (1) take such actions as may

be necessary to assure that statistics developed under

this Act are of high quality, timely, and comprehensive,

as well as specific, standardized, and adequately analyzed

an”dindexed; and (2) publish, make available, and disseminate such statistics on as wide a basis as practicable.

Subsection (e) makes an affirmative requirement that the Agency take necessary actions to

assure that the statistics developed under this

Act are adequate, of high quality, and timely.

The drafters of the Act intended that the Agency

be so charged to maintain the high standards

necessary for health data. Subsection (e) also requires that the Agency make the statistics public

on as wide a basis as practical. The mandate reflects the fact that statistics are valuable only

when they are readily available.

(f) The Agency shall take such action as is appropriate to effect the coordination of health data activities

within the State to eliminate unnecessary duplication of

data collection and maximize the usefulness of data collected.

The intent ‘of subsection (f) is to minimize

duplication of activities while facilitating data

sharing by multiple users. The Agency should not

duplicate resources but build on the capacity of

existing collection and processing systems and

expand resources through interrelationships with

other organizations. These interrelationships

may include reviewing proposed statistical forms,

involving data providers and users representing

both the private and public sectors in decisions

regarding health data activities within the State,

and sharing information and resources through

formal or informal arrangements.

(g) The Agency shall (1) participate with State, 10-

cal, and Federal agencies in the design and implementation of the Cooperative Health Statistics System, a system

for producing comparable and uniform health information and statistics at the Federal, State, and local levels;

(2) undertake and support research, development, demonstrations, and evaluations respecting such cooperative

system; and (3) provide the (State) share of the data collection costs under such system.

Subsection (g) is similar to the authority

which enables NCHS to participate at the Federal

level in the Cooperative Health Statistics System.

It identifies the Agency as a participant in CHSS.

Clause (1) authorizes the Agency to participate with agencies in other States, NCHS, other

Federal agencies, and local agencies in the design

of CHSS, as well as in collection and other aspects of implementation of the system. A major

aspect of the Agencies’ participation in the design

is definition of minimum data sets, sets of uniform data items providing basic information in

each of several specific categories of health data.

Clause (2) authorizes the Agency to assist in

the development of CHSS and thereby to make

whatever additions or modifications are needed

to adequately address specific data needs of the

State.

Clause (3) relates to the cost-sharing aspect

of CHSS. NCHS provides funding assistance to

States for the collection of CHSS data. States

participating in CHSS are expected to assume

their share of the data-collection costs.

Section 5. [Disclosure of Identifiable Health Data. ]

(a) The Agency may make no disclosure of any item,

collection, or grouping of health data which makes the

individual supplying it or described in it identifiable

unless:

(1) The individual described in the data has

consented to the disclosure.

(2) The disclosure is to a governmental entity

in this State, in another State, or the Federal Government,

provided that: (i) the data will be used for a purpose for

which the data were collected by the Agency, and (ii)

the recipient of the data has entered into a written agreement satisfactory to the Agency that it will protect such

data in accordance with the requirements of this Act and

will not permit further disclosure without prior approval

of the Agency.

(3) The disclosure is to an individual or organization, for a specified time period determined by the

Agency, solely for bona fide research and statistical purposes, as determined in accordance with guidelines

adopted by the Agency, and the Agency determines that:

(i) the disclosure of the data to the requesting individual

or organization is required for the research and statistical

pu~oses proposed, and (ii) the requesting individual or

organization has entered into a written agreement satisfactory to the Agency that it will protect such data in

accordance with the requirements of this Act and will

not permit further disclosure without prior approval of

the Agency. In no event, however, may the name, address, or other unique personal identifier of an individual

supplying the data or described in them be disclosed

under this paragraph to the requesting individual or

organization.

(4) The disclosure is to a governmental entity

for the purpose of conducting an audit, evaluation, or

investigation of the Agency and such governmental entity

10
agrees not to use those data for making any determination affecting the rights, benefits, or entitlements of any

individual to whom the health data relate.

Section 5 protects the confidentiality of

identifiable health data collected under the authority in the Act; data collected by the Agency

under another authority would be subject to restrictions on disclosure imposed by that legal

authority; other health data collected under the

authority in this Act may be disclosed at the discretion of the Agency or upon a request that

meets the criteria of the State’s public record

disclosure law.

Disclosure of identifiable health data collected under the authority in this Act is permitted

only under four situations.

1, The purpose of this exception is to permit

access to information in which an individual is identifiable through consent of the

individual so identified. This consent can

be provided either prior to or subsequent

to the collection of the health data. The

Agency may obtain either consent for only

one purpose or a broad consent allowing

disclosure for multiple purposes.

2. The purpose of this exception is to permit

the transfer of uniform health data to

NCHS and other participants in CHSS in

the State and other States without compromising the confidentiality of the health

data by disclosure outside CHSS. This exception permits States and the Federal

Government to meet their data needs without duplication of data collection and

processing. NCHS, for example, has legal

authority to protect data from disclosure.

For the purposes of this subparagraph, the

term “governmental entity” includes nonprofit private organizations that perform

a government function—for example, a

PSRO, which is a private nonprofit organization and operates under Federal law

that protects the confidentiality of identifiable health data. In contrast, an HSA,

also a nonprofit organization operating

under Federal law, could not receive data

under this subparagraph since HSA’S lack

authority to protect the confidentiality

of identifiable health data,

3. The purpose of this provision is to provide ‘organizations like the Institute of

Medicine, university researchers, and other

users of health statistics access to data in

the form in which it is most useful. Disclosure is permitted only for the period of

time specified by the Agency and according to guidelines adopted by the Agency.

It is anticipated that the Agency will promulgate detailed regulations and guidelines

in this regard. Moreover, before allowing

disclosure the Agency must determine that

the data are required for the proposed research and statistical purposes, The drafters

intended that the Agency determine that

no other source of the data is available.

Moreover, the requester must enter a

written agreement with the Agency assuring that it will protect such data in accordance with the requirements of the Act

and will not permit further disclosure

without prior approval of the Agency.

This written agreement must satisfy the

Agency that the requester can comply

with the requirements of the Act for data

protection.

The final sentence under this permitted

disclosure requires further explanation.

The exception permits the disclosure on a

record-by-record basis of all information

contained in a file of statistical records of

individuals except for names, addresses, or

other unique personal identifiers such as

social security numbers. A file of statistical

records of individuals with such unique

personal identifiers removed can still be

regarded as identifiable health data if the

identity of one or more individuals can be

reasonably deduced from other characteristics contained in the file. Examples include a surgeon who performed a certain

type of surgery in a certain hospital or a

black female who is a manager with a high

income in a certain industry in a particular

city.

It is believed that identifiable health

data without unique personal identifiers

serve most of the purposes of statistical

research and provide health data to researchers with detail not usually available

11
to them. This exception does not permit

the recipient researcher or research organization to link the disclosed file with other

files on a record-by-record basis nor to use

the file as a frame for conducting surveys

of the individuals in it. Thus it provides an

additional safeguard to the eventual use

and disposition of the identifiable health

data disclosed. If such an additional safeguard is not deemed necessary or consistent, with goals for sharing health data,

this limitation to full disclosure of identifiable health data can be either omitted or

modified to give the Agency the discretion

for providing identifiable health data

either with or without unique personal

identifiers.

4. The requirements of this disclosure seek

to insure that the authority requesting disclosure for an audit, evaluation, or investigation agrees to maintain the prohibition

on the use of identifiable health data for

regulatory or compliance purposes against

any identified individual.

(b) Any disclosure provided for in Section 5(a) shall

be made at the discretion of the Agency, except that the

disclosure provided for in Section 5(a)(4) must be made

when the requirements of that paragraph have been met.

All disclosures made under subsections (a)(1),

(a)(2), and (a)(3) are discretionary with the

Agency but disclosure under subsection (a)(4)

is required.

(c) No identifiable herdth data obtained in the course

of activities undertaken or supported under this Act shall

be subject to subpoena or simikw compulsory process in

any civil or criminal, judicial, administrative, or legislative

proceeding, nor shall any individual or organization with

lawful access to identifiable health data under the provisions of this Act be compelled to testify with regard to

such health data, except that data pertaining to a party

in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of

such individual to enforce any liability arising under this

Act.

Subsection (c) prohibits release of identifiable

health data for any administrative, judicial, or

legislative proceeding unless the action is actually

brought by or on behalf of the identifiable individual or organization to enforce liability arising

under the Act, Furthermore, where identifiable

health data are available from a primary data

source, such as the patient’s health record maintained by a provider of care, this source, rather

than the abstract of requested data given to the

Agency by the provider of care, should be the

subject of a subpoena. This complete protection

is deemed appropriate to maximize voluntary

submission of identifiable health data.

Section 6. [Security of Health Data. ] The Age~cy

shall take appropriate measures to protect the security

of health data, including:

(1) Limiting the access to health data to authorized individuals who have received training in the

handling of such data.

(2) Designating a person to be responsible for

physical security.

(3) Developing and implementing a system for

monitoring security.

(4) Reviewing periodically all health data to

evaluate whether it is appropriate to remove identifying

characteristics from the data.

(5) Developing a program for the destruction,

on a routine scheduled basis, of all forms, records, or

magnetic tape files maintained by the Agency which

contain information identifying individuals or individual

organizations.

Section 6 provides a series of requirements

designed to implement basic principles for achieving security and integrity of health data. The

provisions create administrative requirements to

prevent unnecessary, unwarranted, or accidental

disclosure of identifiable health data. After much

discussion, the drafters felt that each State

should determine the content of these safeguards

based on the existence of other legislation and

administrative practice, but the safeguards

should be consistent with these provisions.

Technology related to security of health data is

evolving rapidly, and the Agency will need to

become familiar with such technological advancements as they occur.

-—.—. ——.

Implicit in subsection= is the necessity for

training personnel in the appropriate handling of

identifiable health data. Subsection (2), in keeping with principles of good management and data

security, recognizes that a particular person

should be responsible and held accountable for

the physicial security of the health data. Subsections (4) and (5) recognize that in the future

there may be less need for information that

identifies persons or organizations. Subsection

(5) emphasizes that it is appropriate to routinely

12
destroy information identifying individual persons or organizations as soon as such data are no

longer needed.

It is anticipated that the Agency will implement the provisions of section 6 in a manner

consistent with good research and statisticzd

standards.

Section 7. [General Powers. ] In addition to any

other powers authorized by law, in accordance with

State law, the Agency shall have the authority to (1)

make and enter into contracts to purchase services and

supplies and hire consultants; (2) develop and submit

a proposed budget; (3) accept gifts and charitable contributions; (4) apply for, receive, and expend grants; (5)

promulgate regulations appropriate to the effective implementation of this Act; (6) establish charges for and

collect payment from individuals and organizations for

the provision of services, including data dissemination;

(7) receive and expend appropriations; (8) enter into a

reimbursable work program with other agencies of the

State or private agencies under which funds are transferred from such. other agencies to this Agency for the

performance of activities authorized under this Act;

[and] (9) establish and compensate members of advisory

boards subject to shy State law limiting compensation of

advisory board members; [(10) hire employees; (11)

appoint an executive director; and ( 12) provide such other

services and perform such other functions as are necessary

to fulfill its responsibilities under this Act.]

Section 7 contains the general powers and

authorities that need to be included in the Act

unless otherwise provided by other statutory

authority within the State. These powers are

necessary if the Agency is to perform its author1ized functions. For example, the power to enter

into contracts to ‘purchase services is necessary

in order to engage services for the collection of

data; the power to apply for, receive, and expend

grants is necessary in order to provide services

to data users; the power to establish charges and

collect payments for services provided under the

MSHSA is necessary in order for the Agency to

collect data on behalf of other government entities and private not-for-profit organizations; the

power to enter into reimbursable work programs

is desirable in order to enable the Agency to add

staff capability; and the power to establish advisory boards and compensate members is linked

to a CHSS contract requirement to establish

advisory committees.

A State will

powers to fit its

need to tailor these general

particular legal and organizationa.1 structure. A State may also wish more

specific provisions. For example, the composition and functions of an advisory board could

be included.

Section 8, [Criminal.Penalties and Ciuil Remedies. ]

Section 8, while a bracketed optional provision, was thought by the drafters to be important for inclusion in a State code. The provisions

of the Act that prohibit improper disclosure of

data must be enforceable. Section 8 provides

specific criminal penalties and civil remedies for

violations of the Act, These provisions are in

addition to and not in place of any penalties or

remedies provided under existing State law.

Questions of jurisdiction, venue, and applicable

statutes of limitations are to conform to existing

State law.

[(a) In addition to any other criminal penalties under the laws of this State, any individual or organization

that willfully violates any provision in Section 5 or any

regulations implementing that section shall, upon conviction, be fined not more than $(0,000.00), or imprisoned

for not more than (00) months, or both. Such organizations shall be fined not more than $(0,000 .00).]

Subsection (a) provides criminal penalties

for willful violations of any provision in section

5 or regulations promulgated thereunder relating

to disclosure ‘of identifiable health data. The

criminal penalties have been left blank in order

to permit the State to establish appropriate penalties commensurate with existing sanctions or

penalties for similar offenses within the State.

[(b) The Agency or an organization acting upon its

behalf shall be liable to an individual or organization injured by the intentional or negligent violation of any provisions of Section 5 in an amount equal to the damages

sustained by the individual or organization, together with

the cost of the action and reasonable attorney’s fee as determined by the court. ]

Subsection (b) permits an action to be

brought against the Agency or an organization

acting on its behalf for damages that result from

either intentional or negligent violations of the

restrictions on disclosure, The determination of

damages and the question of punitive damages

are left to controlling State law. This subsection

permits the courts to assess court costs and

13
reasonable attorney’s fees if the plaintiff prevails.

This provision is included so that the substantial

costs involved in litigation wiIl not discourage

individuals from bringing meritorious actions

even though actual damages may be small.

Section 9. [Appropriations, ] There is hereby authorized to be appropriated sufficient funds to meet the

purposes of this Act.

Whether section 9 is necessary depends on

the law in a particular State considering adoption of the Act. The financial needs of each

Agency will be dependent on a variety of factors,

including the extent to which an existing organization performs some of the functions authorized in the Act.

Section 10. [Severability. ] [Insert severability

clause,]

Section 10 will contain the standard severability provision used in the State for the unlikely

event that any of the Act’s provisions are subsequently held invalid.

Section 11. [Re@eaL ] [Insert repealer clause.]

Section 11 will contain a standard repealer

clause listing any statute or statutes which are to

be repealed because of the enactment of the Act.

Each State must review existing legislation which

may affect the Act in order to assure appropriate

repeal of any State law which potentially conflicts with the Act’s provisions. Each State is

urged to review existing legislation such as free.

dom of information acts, public record disclosure

laws, and fair information practices acts which

may, in part, conflict with the restrictions on

disclosure of identifiable health data contained

in this Act. It is recommended that disclosure

provisions of this Act should apply since they

are specifically tailored to meet the unique needs

of the Agency.

Section 12. [Effective Date. ] [Insert effective date.]

Section 12 will specify the Act’s effective

date.

LEGALASPECTS OF THE MODEL STATE HEALTH STATISTICS ACT

FEDERAL LAW

During development of the MSHSA, consideration was given to the experience of the

Federal Government and the States with laws for

collecting and protecting health data. This description deals with pertinent Federal legislation,

focusing primarily on matters of privacy, confidentiality, release of data, and organizational

arrangements,

Authority

The Public Health Service Actl authorizes

the National Center for Health Statistics to collect, utilize, and assure the confidentiality of

data on a variety of health matters. The language

1As amended by Public Law 93-35!3, enacted July

28, 1974, and Public Law 95-623, enacted November 9,

1978 (42 USC 242a-242m).

in the MSHSA has been made to correspond to

the Federal law. Subsection 306(b)(l) (42 USC

242k(b)) requires that the Secretary, acting

through the Center, collect statistics on the

following:

“(A) the extent and nature of illness and

disability of the population of the United

States ....

“(B) the impact of illness and disability of

the population on the economy of the United

States and on other aspects of the well-being

of its population ....

o “(C) environmental, social, and other health

hazards,

“(D) determinants of health,

“(E) health resources, including physicians,

dentists, nurses, and other health professionals...and the supply of services by hospitals...

and other health institutions,

14
“(F)

“(G)

“(H)

utilization of health care..,.

health care costs and financing ....

family formation, growth, and dissolution.”

The Public Health Service Act also specifically

authorizes establishment of the Cooperative

Health Statistics System for the purpose of

producing comparable and uniform health information and statistics. Subsection 306 (e) requires

the following:

“(e) For the purpose of producing comparable and uniform health information and

statistics, there is established the Cooperative

Health Statistics System. The Secretary, acting through the Center, shall–

“(1) coordinate the activities of FederaI

agencies involved in the design and implementation of the System;

“(2) undertake and support (by grant or

contract) research, development, demonstrations, and evaluations respecting the

System;

“(3) make grants to and enter into contracts with State and 10CZ.Ihealth agencies

to assist them in meeting the costs of

data collection carried out under the

System; and

“(4) review the statisticalactivities of the

Department of Health, Education, and

Welfare to assure that they are consistent

with the System.

“States participating in the System shall designate a State agency to administer or be responsible for the administration of the statistical activities within the State under the

System. The Secretary, acting through the

Center, shall prescribe guidelines to assure

that statistical activities within States participating in the System produce uniform and

timely data and assure appropriate access to

such data.”

The 1978 amendment (Public Law 95-623)

adds a new requirement–designation of the

State Agency. It is expected that the Agency’s

initial designation in most States will be made

by the Governor, and in fact the Goveniors of

several States have already made such a designation. However, States should additionally consider designating the Agency through the MSHSA.

This procedure would allow the Agency to gain

the benefits of the Law’s various provisions and

a broader acceptance of its role.

Decisions regarding me definition of CHSS,

its administration, and the data it produces are

shared among the participants at the Federal,

State, and local levels and the community of

users CHSS serves. The design principles of CHSS

include: (1) Utilization of a single data collection for various purposes; (2) involvement of

both public and private agencies in data collection and management of the system; (3) sharing

of data by local, State, and national agencies;

and (4) decentralization of data collection and

processing so they are closer to the source of the

data and the location of the primary user of the

data.

NCHS also has the authority to provide technical aid to States and localities. The Public

Health Service Act (subsection 306(d)) provides

the following:

“To insure comparability and reliability of

health statistics, the Secretary shall, through

the Center, provide adequate technical assistance to assist State and local jurisdictions in

the development of model laws dealing with

issues of confidentiality and comparability

of data.”

Conf identicality and Data Disclosure

The confidentiality of health data transmitted

to NCHS is guaranteed. Subsection 308(d) of the

Public Health Service Act (42 USC 242nz(d))

prohibits the publication or release of health data

in which individuals are identifiable without the

consent of the person or establishment supplying the information or described in it. Moreover,

health information can be used only for those

purposes for which it was supplied. Confidentiality protections afforded to the health data

acquired by NCHS supersede any rights granted

to the public or to individuals by either the

Federal Freedom of Information Act or the

Privacy Act of 1974.

The Freedom of Information Act (5 USC

552) provides the public a right to gain access to

information held by the FederaI Government and

prevents the Government from refusing its re15
lease. However, certain information, such as

NCHS health data, is statutorily exempted from

the right to access by subsection 308(d) of the

Public Health Service Act.

The Privacy Act of 1974 (5 USC 552a) was

designed to provide safeguards for individuals

against an invasion of personal privacy by the

Federal Government. Federal agencies must limit

the uses to which information is put and must

give the individual a right to gain access to his

individual records maintained by the Federal

Government, with an opportunity to correct

errors. The Privacy Act provides safeguards

against the misuse of information and prevents

records obtained for one purpose from being

used for another purpose without an individual’s

consent. Only individual information; and not

that on organizations, is protected. When a statute requires a “system of records” to be maintained and used solely for “a statistical purpose,”

the Privacy Act permits the head of the Federal

agency to exempt such records from many of

the requirements of the Act. The Secretary of

Health, Education, and Welfare (HEW), for

example, has exempted certain records maintained and used by NCHS solely as statistical

records.

Organization

The Public Health Service Act establishes

NCHS asan organization that conducts health statistics activities. To the maximum extent feasible,

NCHS must review statistical activities undertaken and supported throughout the various organizational units of HEW to assurethat they are consistent with CHSS. Coordinated utilization of

CHSS information is mandated for certain Federal health data systems. Such mandates can be

found in Federal legislation authorizing national

health planning and professional stahdards review

organizations (PSRO’S). Also, under the most

recent amendment to the Public Health Service

Act (19 78), NCHS is required to produce guidelines to assure that statistical activities within the

States participating in CHSS produce uniform

and timely data and assure appropriate access to

such data.

The National Health Planning and Resources

Development Act of 1974, Public Law 93-641,

subsection 1513(b) (42 USC 3001-2(b)(l)), specifically states that a health systems agency

(HSA), in analyzing and assembling health data,

“shall to the maximum extent practicable use

existing data (including data developed under

Federal health programs) and coordinate its

activities with the cooperative system provided

for under section 306(e).” (42 USCk(e)) HSA’S

must also coordinate their data activities with

PSRO’S (Public Law 93-641, subsection 1513(d)

(42 USC 300L2(d)). PSRO’S are required to coordinate and cooperate with other data systems

under section 1165 of Public Law 92-603 (42

USC 1320c-14). The confidentiality of PSRO

data and sharing of these data with HSA’S are

the subject of HEW regulation 42 CFR 476.

In summary, under the HEW regulations, information from public sources can be shared, as

can data from CHSS-defined minimum data sets

in which individuals arenot identified. Of course,

data that are aggregated and thus conceal the

identity of individuals can be freely shared.

The Cooperative Health Statistics System is

mentioned in another Federal law, the MedicareMedicaid Anti-Fraud and Abuse Amendents,

Public Law 95-142. Subsection 112 l(a) of that

act requires that uniform reporting systems be

established for health services facilities and organizations to the extent practicable and consistent with CHSS.

STATE LAW

Whereas the Federal Government has comprehensive authorization for the collection and

utilization of health data, many States lack similar authority. All States have legislation authorizing them to collect and maintain vital records

and vital statistics, but a study, conducted under

the auspices of HEW in 1976, on the legislation

in a sample of 12 States showed that few States

have comparable specific authority for health

data and statistics. Further support for this conclusion appeared in written comments from various State officials on early drafts of the MSHSA.

Some States appear to collect health data under

general, and often vague, authority. Without

sufficient authority, a State may lack the legal

basis for protecting the

tifiable health data and

confidentiality of id&-

thus lack the ability to

16
participate in and benefit from shared data systems, such as those being established by CHSS.

The legislatures in agrowing number of States

have adopted the principles found in the Federal

Freeflom of Information Act and the Privacy

Act of 1974. Sunshine laws, public record disclosure laws, and other similarly named statutes

correspond to the Federal Freedom of Information Act. Usually a government-maintained record must be released upon public inquiry unless

specific statutory authority establishes confidentiality protection. A data subject in States with

such legislation could have his most personal

health information available to the public upon

a routine request unless identifiable health data

had been specifically exempted from release.

On the other hand, State privacy laws also

create inherent difficulties when they place unreasonable and costly burdens on a health statistics agency. A privacy act gives the data subject

the right to gain access to and correct data relating to him. The purpose is to afford the individu~ the right to know what information is

maintained about him and to insure the accuracy

of individual dataitems utilized for administrative

or regulatory purposes. For statistical purposes,

however, there is no such need for a personal

right to insure accuracy because aggregated data

do not expose such inaccuracy. To provide the

opportunity for access to and correction of data

is to encourage senseless costs. The Federal

Privacy Act of 1974 exempts statistical records

from such requirements. Unless a State has a

similar privacy act with a comparable exemption,

the health data agency is subject to an expensive

burden lacking a corresponding public benefit.

Because there are a variety of very different

laws in the States, any attempt to classify or further evaluate them would lead to confusion. The

laws relating to health statistics, health data, and

public health and safety are as diverse as the

States in which they are found. Moreover, the

interpretation of these laws and their implementation vary even more. A State considering

adoption of the MSHSA needs to make a thorough study of its related, and possibly conflicting, laws with a view to resolving any

conflicts by appropriate modification of the

IWSHSA.

17
APPENDIXES

CONTENTS

I. Excerpts From Laws Pertinent to Health Statistics ......................................................................

The Public Health Service Act .................................................................................................

The National Health Pkmning and Resources Development Act ..............................................

The Social Security Act ...........................................................................................................

The Freedom of Information Act ............................................................................................

The Privacy Act .......................................................................................................................

II. Rules and Regdations Concerning Confidentiality: Health Care Financing Administration- .......

III. NCHS Guidelines to Prevent Disclosures of Identifiable Data .......................................................

19

:

29

33

37

45

48

18
APPENDIX 1

EXCERPTS FROM LAWS PERTINENT TO

HEALTH STATISTICS

THE PUBLIC HEALTH SERVICEACT

Section 306,42 USC Section 242k:

NATIONAL CENTER FOR HEALTH STATISTICS

SErL806. (a) ‘l’hereisestablished in the De artment of

Health, Education, and Welfare the Nationa1’Center for

Health Statistics (hereinafter in this section referred to

as the Wenter”

1

which shall be under the direction of a

Director who s all be appointed by the Secretary and

supervised by the Assistant Secretary for Health (or

such other otlker of the Department as may be deei~ated

by the Semwtary as the principal adviser to hlm for

health programs).

(b) In carrying out section 304(a), the Secretary, acting through the Center—

(1)shall collect statisticson—

(A) the extent and nature of illness and disability of the population of the United States

(or of any ~roupin~ of the people included in

the opu]atIon), including life expectancy, the

incit ence of various acute and chronic illnesses,and infant and maternal morbidity and

mortalit ,

(B) t~e impact of illness and disability of

the population on the economy of the United

States and pn other aspects of the well-being of

Its population (or of such groupings),

(C) environmental, social, and other health

hazards,

(D) determinants of health,

(E) health resources, including physician,

dentist:, nurses, and other health professionals

by spec]alty and type of practice and the sup~l?

of services by hospitals, extended care facdlties, home health agencies, and other health

institutions,

(F) utilization of health care, including utilization of (i) ambulatory health services b

specialties and types of practice of the healti

professionals providing such services, and (ii)

eervlces of hospitals, extended care. facilities,

home health agencies, and other institutions.

(G) health care costsand financing, including

the trends in health care rim and cost, the

sources of payments for hea!’th care services,and

Federal, State, and local governmental expenditures for health care services, and

19
. (H) family formation, growth, and dissolu- .

(2~s% undertake and support (by grantor contract) research, demonstrations, and evaluations

respectin new or improved methods for obtaining

current

f ata on the matters referred to in paragraph (1);

(3) may undertake and sup ort (by grnnt or cmtract) epidemiological researc! , demonstrations,and

evaluations on the matters referred to in paragraph

(1); and

(4) may collect, furnish, tabulate, and analyze statistics, and prepare studies, on matters referred to in

paragraph (1) upon request of public and nonprofit

private entities under arrangements under which the

entities will pay the cust of the serviw provided.

Amounts appropriated to the Secretary from payments

made under arrangements made under aragraph (4)

shall be available to the Secretary foro\ ligation until

expended.

$)c The Center shall furnish such special statistical

an epidemiological compilations and surveys as the

Committ.eaon Human Resources and the Committee on

.Appropriations of the Senata and the Committee on

Interstate and Foreign Commerce and the Committee on

,~ppropriations of the House of Representatives may request, Such statistical and e idemiological compilations

and surveys shall not bemJe subject to the.payment of

the actual or estimated cost of the preparation of such

compilations and surveys.

(d) To insure comparability and reliability of health

statistics, the Secretary shall, through the Center, provide adequate technical assistance to assist State and

local jurisdictions in the. development of model laws

dealing with issues of confidentiality and comparability

of data.

(e) For the purpose of producing comparable and uniform health information and statistics, there is established the Cooperative Health Statistics System. The

Secretary, actin throuh the Center, shall—

(1) coorf%matete activities of Federal agencies

involved in the design and implementation of the

System;

(2) undertake and support (by grant or contract)

research, development, demonstrations, and evaluations respecting the System;

(3) make grants to and enter into contracts with

State and local healtha encies to assistthem in meeting the costs of data coflection carried out under the

System; and

(4) review the statistical activities of the Department of Health, Education, and Welfare to assure

that they are consistent with the System.

States participating in the.System shall designatea State

agency to administer or be responsible for the administration of the statisticalactivities within the State under

the System, The Secretary, acting through the Center,

shall prescribe guidelines to assure that statistical activi20
ties within States participating in the system produce

uniform and timely data and assure appropriate access to

such data.

(f) To assist in carrying out this section, the Secretary,

acting through the Center, shall cooperate and consult

with the Departments of Commerce and Labor and any

other interested Federal departments or agencies and

with State. and local health departments anda encies.

For such purpose he shall utilize insofar as possl% le the

services or facilities of any agency of the Federal Government and, without regard b section 3709 of the Ravieed Statutes (41TJ.S.C.5),of any appropriate State or

other public agency, and may, without regard to such

section, utilize the services or facilities of any private

agency, organization, group, or individual, in accordance

with written agreements between the head of such agency,

or anization, or f !??

oup and the Secretary or between such

in ividual andte Secretary. Payment if any, for such

services or facilities shall be made in such amounts a: may

be provided in such reement.

(~) TO secure uniY ormit~ in the registration and collection of mortality, morbidity, and other health data,

the Secretary shall prepare and distribute suitable and

necessary forms for the collection and compilation of

such data which shall be published asa part of the

health reports published by the Secretary.

(h) There shall be an annual collection of data from

the records of births, deaths, marriages, and divorces in

registration areas. The data shall be obtained only from

and restricted to such records of the States and municipalities which. the Secretary, in his discretion, determines possess records affording satisfactory data in necessary detail and form. Each State. or registration area

shall be aid by the Secretary the Federal share of its

reasonab f’e costs (as determined by the Secretary) for

collectin and transcribing (at the request of the Secretary an$ by whatever method authorized by him) its

records for such data.

(i) The Center may

!

rovide to public and nonprofit

private entities engage in health plannin activities

technical assistance in the effective use in suc‘% activities

of statistics collected or compiled by the Center.

i)j In carrying out the requirements of section 304(c)an paragraph (1) of subsection (e) of this section, the

Secretary shall coordinate health statistical and epidemiological activities of the Department of Health, Education, and Welfare by—

(1) establishing standardized means for the collection of health information and statistics under

laws administered by the Secretary;

(2) developing, in consultation with the National

, Committee on Vital and Health Statistics, and maintaining the minimum sets of data needed on a continuing basis to fulfill the collection requirements of

subsection (b) (1);

(3) after consultation with the National Committee on Vital and Health Statistics, establishing

standards to assure the quality of health statistic ‘5’

21
and epidemiological data collection, processing, and

analysis;

(4) in the case of reposed health data collections

of the Departmentw! ich are required to be reviewed

by the Director of the Office of Management and

Budget under section 3509 of title 44, United States

Code, reviewing such proposed collections to determine whether they conform with the minimum sets

of data and the standards promulgated ursuant to $

paragraphs 2) and (3), and if any suc% proposed

collection is ound not to be in conformance, by takin such action as may be necessary to assure that it

WIf1conform to such sets of data and standards, and

~)ti periodically reviewing ongoing health data

co] &tions of the Department, subject to review

under such section 3509, to determine if the collections are being conducted in accordance with the

minimum sets of data and the standards promul ated

pursuant to paragraphs (2) and (3) and,i

f any

such collection is found not to bem conformance,

b taking such action as may be necessary to assure t{at the collection will conform to such sets of data

and standards not later than the nineteenth day after

the date of the comdetion . of the review of the

Collection.

(k) (1) There is established in the C)fice of the Secretary a committee to be known as the National Committee on Vital nnd Heal: h Statistics {hereinafter in this

subsection referred to as the “committee>’) which shall

consist of hftcen members.

(2) (A) The members of the Committee shall be appointed by the Secretary from among persons whcJhave

distingmshed themselves in the fields of health statistics,

health plannin

%, epidemiology, and the provision ofhealth services. xcept as provided in subparagraph (B),

members of the Committee shall be appointed for terms

of three ears.

(B) ~f the members first appointed—

(~) five shrill bP appointed for terms of one year,

~)n five shall be appointed for terms of two years,

an

(iii) five shall be appointed for terms of three . .

years,

as designated by the Secretary at the tim,e of appointment. Any member appointed to fill a vacancy occurrin

prior to the expiration of the term for which his prof-

ecessor was appointed shall be appointed only for the

remainder of such term.A member may serve after the

expiration of his term until his successor has taken office.

(3) Members of the Committee shall be compensated

in accordance with section 208(c).

(4) I! shall bc the+function of the Committee to nssist

and advise the Secretary—

(A) to delineate statistical problems bearing on

health and health services which are of national or

international interest;

(B) to stimulate studies of such problems by other

organizations and agencies whenever possible or to

22 .
make investigations of such problems through subcommittees;

(C) todetermine, approve, andrevise the terms,

definitions, classifications, and guidelines for assessing health status and health services, their distribution and costs, for use (i) wit hin the Department of

Health, Education, and Welfare, (ii) by all ,programs administered or funded by the Secretary, including the Federal-State-local cooperative health

statistics system referred to in subsection (e), and

(iii) to the extent possible as determined by the head

of the agency involved, by the Veterans’ Admini: -

tration, the Department of Defense, and other Federal agencies <concerned with health and health

services;

(D) with respect to the design of and approval of

health statistical and health information systems

concerned with the collection, processing, and tabulation of health statistics within the Department of

Health, Education, and Welfare, with respect to the

Cooperative Health Statistics System established

under subsection (e), and with respect to the standardized means for the collection of health information and statistics to be established by the Secretary

under subsection (j) (1) ;

(E) to review and comment on findings and proposals developed by other organizations and agencies

and to make recommendations for their adoption or

implementation by local, State, national, or international agencies;

(F) to cooperate with national committees of other

countries and with the Wor]d Health Organization

and other national agencies in the ~tudies of problems of mutual interest; and

(G) to issue an annual report on the state of the

Nation’s health, its health services, their costs and

distributions, and to make proposals for im rovement of the Nation’s health statistics and { ealth

information systems.

(5) In carrying out health statistical activities under

this part, the Secretary shall consult with, and seek the

advice of, the Committee and other appropriate pro festuonal advisory groups.

23
Section 308(d), 42 USC Section 242m(d):

(d) No information obtnined in the course of activities

undertaken or supported under section 304,305,306,30’7,

or 309 may be used for any purpose other than the urpose for which it was supplied unless authorizJ-’ by

guidelines in effect under section 306 (1) (2) or under

regulations of the Secretary; and (1) in the case of information obtained in the course of health statistical or

epidemiological activities under section 304 or 306, suoh

information may not be published or rekmsed in other

form if the particular establishment or erson supplying

the information or described in it is ii entiflable unless

such establishment or person has consented (as determined under regulations of the Secretary) to its publication or release in other form, and 2) in the case of

information obta,ined in the course of Lealth services reeearch, evaluations, or demonstrations under section 304

or 305, such inf ormation may not be published or released

in other form if the person who supplied the information

or who is described in it is identifiable unless such person

has consented (as determined under regulations of the

Secretary) to its publication or release in other form.

“24
THE NATIONAL HEALTH PIANNING AND

RESOURCES DEVELOPMENT ACT

Public Law 93-641

Section 1513(b), 42 USC Section 3001-2 (b)(l ):

“(b)” In providing health planning and resources development for

its health service area, a health systems agency shall perform the

following functions:

“(1 ) Thea ency s!MI1 assemble an;l aIliLlyx data concerning-

“ (A) tfie status (and its {determinants) of the health of

the residents of its health service area.

“ (B) tl~e status of the healt]l cnre delivery system in the

area and the use of that system by the residents of the area,

“(~) the effect tl,e area’s health care delivery system has

on the health of t he residents of the area,

“ (D) the number. tv e, and location of the area’s health

resources, including hea‘f th services? manpower, and facilities,

“(E) the patterns of utilization of the nrea”s health

resources, and

“ (F) the environmental m,d occupational exposure factol~

affecting immediate and long-t erm Ilea lth conditions.

Coordination In carrying out this paragraph, the agenc,y shall to the maximum

tith oooper- extent racticable use existing data (inc]udmg data developed under

at ive system. Federa 1’health pro~rams) and coordinate its acti~it ies with the coop42 USC242d. erati}-e system prowded for under section 306(e) .“

25
Section 1513(d), 42 USC Section 3001-2(d):

~~d Each health systems qgency shall coordhate its activities CoOrMm*5.m. ,vit(~

“(1 ) each Professional Standmds Review organization (ales- 42 ~~c ~3200~

ignated under section 1152 of the. Social Security Act),

“ (2) entities referred to in paragraphs (1) and (2) of section

-.

204(a) of the Demonstration Cities and Metropolitan Development Act of 1966 and regiomd and local entities the views of 42 usc 3334.

whkh are required to be considered under regulations prescribed

under section 403 of the Intergove.rnmcntmlcooperation Act of

1968 to carry out section 401(b) of such Act, 42 USC 4233,

“(3) other appropriate general or special purpose regional 4231.

planning oradministrative a.genci.w,and K(4) ~yother appropria~ent1tY7

in the health system agency’s health service area. The agency shall,

as ap ropriate, secure data from them for use in the ag:ncy’s pla.nnin

and $evel.opment activities, enter into agreements with them whlc“f

will assure that, actions taken by such entities which alter the area’s

health system will be taken in a manner which is consistent with the

HSP and the AH? in effect for the area, and, to the extent practicable,

provide technical assistance to such entities. ”

26
Section 1522(a) and (b)(l)-(7):

6%TATE ADM lNIS’1’R.\TIVE I’ROORAM

42 USC 300m-lo ‘“SEC.1MZ2. (a) A State administ mtive program (hereinafter in

this section ref:med to as the ‘State Program’) is a program for the

performance within the Stite by its State .4gency of the functions preconditions. scribed by section 1523. The Secretary may not approve a State Program for a State unless it—

“(1 meets the requirements of subsection (b);

“ ~12 has been submitted to the Secretar ‘ by the Governor of

the tate at such ,time and.in such detail, an d contains or is accompanied by such mformat~on, ns the Secretary deems necessary;

Funot’ionsD

and

“(3] has been submitted to the Secretary only ufter the Governor o the State has afforded to the general public of the State a

reasonable opportunity for n present at ion of views on the State

“(~ ORemStatq Program of a State nlust-

“J1) ~rovlde for the performance within the State (after the

demgnatlon of a State.4 ency and in accordance with the designation agreement) of the ‘1unctions prescribed by section l&23 and

specify the State Agency of the State as the sole agency for the

performance of such functions (except us provided m subsection

$)b of such section) and for the aclminlstration of the State

‘:fl’&kain or be supported by satisfactory evidence that

the State Agency hns under State law the authority to carr

out such functions am-l the State Program in accordance wlt“i

this part and contain a current budget for the operst.ion of the

State .4genc.y;

“(3) prmude for adetluate consultation with, and authority

for. the Statewide Health Coor(lintiting Council (prescribed by”

section 15%4), in carrying out such fnnctions and the State

Prowam;

‘~&) (A) set fort!] in ~uch deti,il as the Se:::&:in~~i:r~:

scribe tht? quallficwt ions for personnel havin

the performance of such functions rmd the s tate Program, and

I’equiw t h[?State Agency to hwvt?a professi@al staff for planning

and a professional staff for development, which staffs shall be of

such :Me and meet SUCh qualifications m the Secretary may

prescribe;

“(B) ~de for such methods of administration as are found

by the ecretary to be necessary for the proper and efficient

administration of such f unctione and the State Program, including

methods relating to the establishment and maintenance of personnel etandards on a merit basis consistent with euch standards

as are or may be established by the Civil Service Commission

under section 208 (a) of the Intergovernmental Personnel Act of

42 USC 4728, 1970 (I?ublic Law 91–648 ), but the Secretary shall exercise no

authority with respect to the selection, tenure of office, ancl compensation of any individual employed in accordance with the

methods relating to personnel standards on a merit basis established and maintained in conformity with this paragraph;

“(5 require the State Agency to perform its functions in

accor Jante with procedures and criteria established and published

by it, which prorecluree nnd criteria SIXI!Ironform to the requirements of section 1532;

“(6) require the State Agermy to (.4) conduct its businese meet -

~ngs in public, (B) give adequate notice to the public of such meetmgs, ancl (C) make its records and clata a~ailable, upon request,

to the public;

Coordination “(7) (.4) provide “for the coor(lination (in accor(lanee with

of in forma- regulations of the Secretnry ) with the coopmwt iw system pro-

*ton. vialed for uncler seckion 306 (e) of the activities of the State .+gency

42 USC 242d, for the collection, retrieval, analysis,. reporting, and pnbl]cntion

27
of statistical and other information related to l:ealth .md lxwlth

Reports. care, and (13) require providers of health care doing business in

the State to make statistical and other reports of such information to the State .\gency .“

28
THE SOCIAL SECURITY ACT

Section 1121(a), Part A, Title Xl, 42 USCSection 1320u:

Uniform Reporting Systems for Health Services Facilities and

Organizations’

Sec. 1121. (a) Forthe purposes of reporting the cost of services

provided by, of planning, and of measuring and comparing the efficiency of and effective use of services in, hospitals, skilled nursing

facilities, intermediate care ,facilities, home health agencies, health

maintenance organizations, and other types of health services facilities and organizations to which payment maybe made under this Act,

the Secreta~ shall establish by regulation, for each such type of

health services facility or organization, a uniform system for the

reporting by a facility or organization of that type of the following

information:

(1) The aggregate cost of 1peration and the aggregate volume

of services.

(2) The costs and volume of services for various functional

accounts and subaccounts.

(3) Rates, by category of patient and class of purchaser.

(4) Capital assets, m defined by the Secretary, including (as

appropriate) capital funds, debt service, lease agreements used

in lieu of capital funds, and the value of land, facilities, and

equipment,

(5) Discharge and bill dnta.

The uniform reporting system for a type of health services facility or

organization shall provide for appropriate variation in the application of the system to different classes of facilities or organizations

within that type nncl shall be established, to the extent practicable,

consistent with the cooperative system for producing comparable and

uniform henlth information and statistics described in section 306(e)

(1) of the Public Health Service Act. In reporting under such a system, hospitals shall employ such chart of acc,ounts, definitions, principles, and statistics as the Secretary may prescribe in order to reach

a uniform reconciliation of financial and statistical data for specified

uniform reports to be provided to the Secretary.

I Section 1121 was added by sec. 19(a) of P,L. 95-142. See also sec. 19(c) which is

printed in thin document oh p, 800.

29
Section 1165,42 USC Section 1320c-I 4:

Correlation of Functions Between Professional Standards Review Organizations and Administrative Instrumentalities

Sec. 1165. The Secretary shall by re~nlations provide for such correlation of activities, such interchange of data and inf ornmtion, and

such other cooperation consistent with economical, efficient, coordinated, and comprehensive implementation of this part (including, but

not limited to, usage of existing mechanical and other data-gathering

capacity) between and among—

(a) (1) agencies and organizations which are parties to agreements entered into pursuant to section 1816, (2) carriers which

are parties to contracts, entered into pursuant to section 1842,

and (3) any other public or private agency (other than a Professional Standards Review Organization) having review or control functions, or proved relevant data-gathering procedures and

experience, and

(b) Professional Standards Review Organizations, as maybe

necessary or appropriate for the effective administration of title

XVIII, or State plans approved under this Act.

30
Section 1166,42 USC Section 1320c-I 5:

Prohibition Against Disclosure of Information 1

Sec. 1166. (a,) Any data or information acquired by any Professional Standards Review Organization, in the exercise of its duties

and functions, shall be held in confidence and shall not be disclosed

to any person except (1) to the extent that may be necessary to carry

out the purposes of this part, (2) in such cases and under such circumstances as the Secretary shall by regulations provide to assure

adequate protection of the rights and interests of patients, health

care practitioners, or providers of health care, or (3) in accordance

with subsection (b).

(b) A Professional Standards Review Organization shall provide,

in accordance with procedures established by the Secretary, data and

inf ormation—

(1) to assist Federal and State agencies recognized by the

Secretary as having responsibility for identifying and investigating cases or patterns of fraud or abuse, which data and

information shall be provided by such organization to such

agencies at the request of such agencies at the discretion of such

Organization on the basis of its.findings with respect to evidence

of fraud or abuse; and

(2) to assist the Secretary, and such Federal and State agencies recognized by the Secretary as having health planning or

related responsibilities under Federal or State law (including

health Sptenis a:encies and Stiate health planning and development agencies), m carrying out appropriate health care planning and related activities, which data and information shall be

provided in such format and m~nner as may be prescribed by the

Secretary or agreed upon by the responsible Federal and State

agencies and such Organization, and shall be in the form of

aggregate statistical data (without identifying any individual )

on a geographic, institutional, or other basis reflecting the volume and frequency of services furnished, as well as the demographic characteristics of the population subject to review by

such Organization.

The penalty provided in subsection (c) shall not apply to the disclosure of any data and information received under this subsection,

except that such penalty shall apply to the disclosure (by the agency

receiving such data and information ) of any such data and information described in paragraph (1) unless such disclosure is made in a

judicial, administrative, or other formal legal proceeding resulting

from an investigation conducted by the agency receiving the data and

information.

1section 1166 was amended by sec. 5(h) of P.L. 95-142.

31
(c) It shall be unlawful for any person to disclose any such information other than for such purposes, and any person violating the

provisions of this section shall, upon conviction, be fined not. more

than $1,000, and imprisoned for not more than six months, or both,

together with the costs of prosecution.

(d) No patient record in the possession of a Professional Standards Review Organization, a Statewide Professional Standards

Review Council, or the National Profe~ional Standards Review

Council shall be subject to subpena or discovery proceedings in a civil

action.

32
THE FREEDOM OF INFORMATION ACT

5 USC Section 552:

!552. Public information; rtgency rules, opinio~.s, orders, records, and

proceedings

(a) Each agency shall make available to the public information M follow:::

.(1) Each agency shall separately state and currently publish in the Feder;d

Register for the guidance of the public—

(A) descriptions of its central and field organization and the cstahlished

places at which, the employew (and in the caaeof a uniformed service, the

members) from whom, and the methods whereby, the public may obtain

information, make submittals or requests, or ohtnin decisions;

(B) statements of the general course and method by which its functions

are channeled and determined, including the nature and requirements of

all formal and informal procedures available;

(C)rulesof procedure, descriptions of forms availnble or the places at

which forms may be obtained, and instructions as to the scope and con t.cnts

of all papers, reports, or examinations;

(D) ‘substantive rules of general applicability adopted as authorized hy

law, and statements of general policy or interpretations of general npplic:!-

bilit y formulated and adopted by the agency; and

(E) each amendment, revision, or repeal of the foregoing.

Except to the extent that a pereon has actual and timely notice of the terms

thereof, a pereon may not in any manner he required to resort to, or he adversely

affected by,”a matter required to be published in the Federal Register and not so

published. For the purpose of this paragraph, matter reasonably available to

the class of persons affected thereby is deemed published in the Federal Register

when incorporated by reference therein with the approval of the Director of the

Federal Register.

(2), Each agency, in accordance with published rules, shall makq available for

public inspection and copying—

(A) final opinions, including concurring and dissenting opinions, M WCII

as orders, made in the adjudication of cmes;

(B) those statement.. of policy and interpretations which have been

ado ted by the agency and are not published in the Federal Register; and

(8) administrative staff manuals and instructions to staff that atiect a

member of the public;

unless the materials am promptly publish~d and copies oflered for sale. To the

extent required to prevent a clearly unwarranted invasion of ersonal privacy,

an agency may delete identifying details whep it makes availab fe or publishes an

opinion, statement of policy, interpretation, or staff manual or instruction. However, in each case the jtmtificaticin for the deletion shall be explained fully in

writing. Each agency shall also maintain and make available for public inspecting

and copying current indexes providing identifying information for the public

as to any matter issued, adopted, or promulgated after July 4, 1967, and required

by this paragraph to be made available or published. Each agency shrill promptU’

publish, quarterly or more frequently, and distribute (by sale or otherwise)

copies of each index or supplement.. thereto unless it determines by order published

in the Federal Register that the publication would be unnecessary and impracticable, in which case the agency shall nonetheless provide copies of such index

on request at a cost not to exceed the direct coRt of duplicatkm. A final order,

opinion, etatement of policy, interpretation, or staff manual or instruction thnt

affects a member of the public may be relied on, used, or cited as precedent by

an agency against a party other than an agency only if—

(i) it has been indexed and either made avtilable or published C-Sprovided

by this paragraph; or

(ii) the party has actual and timely notice of the terms thereof.

(3) Except with respect to the records made available under paragraphs (1)

and (2) of this subsection, each agency, upon my request for records which (A)

reasonably describes such recnrds and (B) is made in accordance with published

rules+ststing the time, place, fees (if any), and procedures to he followed, shall

make the records promptly available to any person.

(4) (A) In order to carry out the provisions of this section, each agehcy shall

promulgate regulations, pur.eu’ant to notice and receipt of public comment,

specifying a uniform schedule of fees applicable to W constituent uni$s of such

agency. Such fees sh@l he limited to reasonable standard charges for document

search and duplication and provide for recovery of only the direct costs of such

search and duplication. Documen”ti shall be furnished without charge or at a

reduced charge ‘where the agertcy determines that waiver or reduction of the fee

is in the public interest because furnishhg the information can be considered as

primarily benefiting the general public.

33
(B) On complaint, the district court of the United States in the district

in which the complainant resides, or has his prfhci al place of business, or

in which the agencv records are situated, or in the #istrict of Columbia, hasi

jurisdiction to enjoin the agency from withholding agency records and to

order the production of any agency records improperly w]thheId from the

complainant. In such a case the court shall determine the matter de novo,

and may examine the contents of such agency records in camera to determine

whether such records or any part thereof shall be withheld under any of the

exemptions set forth in subsection (b) of this section, and the burden is cm

the agency to sustain its action.

(C) Notwithstanding anv other provision of law, the defendant shall

serve an nnswer or otherwi;e plead to any complaint made under this subsection within thirty day~ after service u

r

n the defendant of the plending

‘in which such complaint M made, unless t e court otherwise directs for good

cause shown.

(D) Except as to cases the court considers of greater importance, proceedings

before the district court, as authorized by this subsection, and appeals

therefrom, take precedence on the docket over all cases and shall be assigned

for hearing and trial or for argument at the earliest practicable date and

expedited in every WRY.

(E) The court may awess against the United States reasonable attorney

fees and other litigfitirm costs reasonably incurred in any case under this

section in which the complainant has substantially prevailed.

(F) Whenever the court orders the production of any agency records

improperly withheld from the complainant and msesses against the United

States reasonable attorney fees and other litigation costs, and the court

additionally issues a written finding that the circumstances surrounding the

withholding raise questions whether agency personnel rtcted rmbitr4rily or

capriciously with respect to the withholding, the Civil Service Commission

shrill promptly initiate a proceeding tn determine whether disci Iinnry action

is warranted against, the nfflcer or employee who wos primar]Yy responsible

for the withholding. The Commission, after investigation and consideration

of the evidence submitted, shall submit its findings nnd recommendations to

the administrative authority of the agency concerned nnd shrill send copies

of the findings and recommendations to the officer or employee or his representative. The administrative nuthority shrill take the corrective action that

the Commission recommends.

(G) In the event of noncompliance with the order of the court, the district

court may punish for contempt the responsible employee, and in the case of

a uniformed service, the responsible member.

(5) Each agency having more than one member shall maintain and make available for public inspection a record of the final votes of each member in every

ioceeding.-

ag&[AY Each agency, upon any request for records made under paragraph (IY,

(’2), or (3) of this subsection, shall—

(i) determine within ten days (excepting Saturdays, Sundays, and legal

public holidays) after the receipt of any such request whether to compl

with such re uest and shall immediately notify the person mnking suc

?-l

{

request of suc determination and the reasons therefor, and of the right of

such person to appeal to the head of the agency any adverse determination;

and

(ii) make a determination with respect to any appeal within twenty days

(excepting Saturdays, Sundays, and legal public holidays) after the receipt

of such appeal. If on appeal the denial of the request for records is in whole or

in part upheld, the agency shall notify the person making such request of

the provisions for judicial review of that determination under paragraph (4)

of thk subsection.

(B) In unusual circumstances as sl]ecificd in this subparagraph, the time

limits rescribed in either clause (i) or clause (ii) of subparagmph (A) may be

extenc1’ ed by written notice to the person making such request setting forth

the reasons for such extension and the date on which a determination is

expected to be dispatched. No such notice shall specify a d~te that would

result in an extension for more than ten working days. As usrd in this subparagraph, “unusual circumstances” means, but only to the extent rcasc)nably necessary to the proper processing of the particul:m request-

(i) the need to search for and collect the requested records from Md

facilities or other estaMishments that are separate from the office nrocessirm

the request;

.

(ii) the need to search for? collect, and appropriately rxnnline a volunlin[,lls

amount of separate and distinct records which are demanded in a singk

request; or

(iii) the need for consultation? which shall be conducted with all practicnl)lr

speed, with another agency hav]ng a sui>stanti:ll interest in the dcterminati[]n

of the request or among two or more components of the agency having

substantial subject-matter interest therein,

34
(C) Any person mtiking a request to any agency for records under parngraph (1), (2), or (3) of this subsection shun he deemed to have exhausted

his administrative remedies with respect to sl]ch request if the agency f:tils

to comply with the applicable time limit prt~visions of this paragraph. If

the Government can show exceptioniil circumstances exist and that the

agency is exercising due diligence in responding to the request, the cour~

may retain jurisdiction and allow the agency additional time to complete

its review of the records. [Jpon sny drtcrmin:ltion by an agency to comply

with a request for records, the records shall be made promptly avfiil:~hlc

to such person making such request. Any notification of denial of any requwt

for records under this subsection shall set forth the names and titles (w

postions of each person responsible for the deniul of such request.

(b) This section dots not ripply to mattrrs th:lt a.re—

(1) (A) specifically authorized under rritcri:~ cstuhlished by nn Executive

order to he kept secret, in the interest uf nntionul defense or fnreign policy nnd

(B) me in fact properly classified pursuunt t[~ such Executi\,e order;

(2) rcl:ited solely to the internal personnel rules nnd practices of an abcncy;

(3) specifically exmnptcd from disclosure hy statmte;

(4) trade secrets and commercial or fin:mcinl information obtained from a

person tmd privileged or confidential;

(.5) inter-ugcncy or intra-agency n]cmorandt]ms or letters which would not br

avttiluhlc hy law tu a party other than nn :lgcncy in litigation with the ogency;

(6), Personnel and mcdicul film :md similar hlm the discl{,s~lrc ,,f ~vhich W,,,l]d

const]tutc a clcnrly unwatvtmt cd invasion of ix-rson:d privocy;

(7) investigatory records cutnpilcd for l;lw enforc(,n)ent purposes, but only t{, the

extent that the production of such records would (.4) interfere with enforccnwnt

proceedings, (B) deprive u pcrsnn of n right to a fnir triul m m impartiul ndjl]dicuti[m, (C) constitute on unw:lrr:mtt~d inv:lsil)n of I)ersonal I)riv;lcy, (1)) discl[)+l~

the indentity of u crmfidcnti:d source ;md, ill the C:MCof a record compik~d hy ii

crimimd law onforcem(mt ;Lllth(jrit.y in the cours(, of II criminal illvestigtit ion, or

i)y an agency conducting o I:lwful n:lti[)n;il srcllrit~ intclligrncc in~$wtig:it ion,

con fidcnti:d infnrrnation furnished only Ijy tbc conhdcntiai w~urcr, [E) disclo+,

investigative tcchniqws md procrdurw

sufety of luw enforcement personnel;

, or (F) endanger the Iifc or physical

(8) crmtuincd in m rdotcd to exnminntion, opcmting, {)r condition rqxmts

prcpnrcd !)y, on tmh:df of, or for the IISUt,f :In :Igency rrymnsihl(. for the rrgul:lti(m

or sltpcrvlslon of !hmnciul institutions; (w

(f)) gcologicrd nnd geophysic:d inform:lt.ion und data, including nMIN, concerning wells,

Any rem-mnhly sogregnhlc portion of n record sh:dl ho rm,ided tt) :lny pcrs(m

requesting such record after delrtion of th[, I)ortinns whit i nre c.xmnpt IIndor this

subsection.

(C) This sectirm dots not nuthorim withholding of infrmmntion or limit the

nvtiilabilit y of records to tho put)lic, exLxqjl :is sl)(,cific:dly stntod in this section.

This section i~ not ttuthority to withhold information from Congress.

(d) On or before Maroh 1 of eaoh oalendar year, eaoh agenoy shall submit a

report oovering the preceding oalendar ear to the Speaker of the House of

Representatives and President of the E/&ate for referral ta the appropriate

committees of the Congress, The report shall inolude-

(1) the number of determinations made by such agenoy not to comply with

requests for records made to suoh agency under subsection (a) and the reasons

for eaoh suoh determination;

(2) the number of appeals made by ersons under imbsection (a) (6), the

result of such ap eals, and the reason /’or the action upon each appeal that

remits in a denia /’of information;

(3) the names and titles or positions of eaoh person res onsible for the

denial of reoords requested under this section, and the num\ er of instanoee

of anticipation for each;

~) the results of each proceeding conducted pursuant to subsection

(a) (4) (F), including a report of the disciplinary action taken a ainst the

oflicer or employee who was primarily responsible for improperly wfthholding

records or an explanation of why disciplinary action was not taken;

(5 a copY of every rule made by such agency regarding this section;

(61 a oopy of the fee schedule and the total amount of fees collected by

the agent for making records available under thk section; and

ee~~~n~~ other information aa indicates efforts to administer fully this

The Attorney General shall submit an annual report on or before March 1 of

each oalendar year which shall include for the prior calendar year a listing of the

number of cases arising under this section, the exemption involved in each case,

the deposition of such case, and the cost, fees, and ~enalties assessed under

subsechons (a)(4)(E), (F), and (G). Such report shall a so include a description

of the efforts undertaken by the Department of Justice to encourage agency

compliance with this section.

35
(e) For pur~os~ of this section, the term “agency” as defined in section 551(1)

of this title mcludea any executive de artment military department, Governwent corporation, Gwemmqnt pontro l’~led eor oration, or other qtablis@nent

in the executive branch of the Government (kc uding the Executive Office of the

president), or any independent regulatory agency.

36
THE PRIVACY ACT

Public Law 93-579

5 USC Section 552a:

!, ~.. r,~,?tq. ‘$ !i52a. Records maintained on individuals

“(:1) 1)1:1’1S1’1’10Ss. -l;or I)llrlx}st’s~)t’this s~~,,titul--

“( 1) tll(’ t(ll’111‘il~oll(o~” 111(’illlS il~(ll(,} w [l(~lill(,tl ill Stwtil)ll

~ ‘s.: C,S,:, .’).iti((l)of’this lit](,:

“(2) ~llc tell!] ‘i]l[li\i~l[]:ll’ tIII.:lIISil (.itix(,ll of” t}l(, [-nit(xi Stntw

01’:111 !lll( ,11lil\Ytllll Y ;I(llllitt(>(l !I)l” I)(il.lll:lll(>llt r(wi(l (.11(,(,:

“(:1) tlv? t(’t’111‘t’tl:tilltaill” inclll(los Itl:lil]tilill. ,wllwt. IISV,or (lis-

:Igvll($y. illciu(litlg. Inlt not Iinlitcd tn. Ilis wlu~wtion. lill:kci:ll

Il’ill)Sll(”ti(llIS, I]wdic:lll]istory, illld i’l”il]lil)illt)],~~lll])loylll~>]lthistory

;11111Illtlt (wl]t:li]ls l)is lI~IIuL,.or t]w i(l[,lltifyiug numlwr. symbol,

or [)tllcr itlotll it’yi]lg lnlrtivul:~r :lssigl]ed to tile in(lividwl? such

ilS 1. lill~rer 01” VOI(W pril]t or :1 pllotog’1.:tl)]l” :

‘“(5) tile ((JIIII ‘syst(wl of IxxY)Ixlh. IINWIIS :t group of any records

1111(1[>1’ tllo (’OIltl’ol of il]ly il~(lll(’\f fl’olll which infommtion is

retri~wvl I)y tlw m]nw of tlw ill{l~vi(lu:tl (II’ by some identifying

Illmlllvl’, ,~ymlml, OIOotlwr itlent it’j’illg p:lf$i(wl;lr :lssigned to the

illllivi(llliil :

“ (G) tll(} terlll ‘Stjttistic,ill I’(w.f)l:cl’ lll(lill)S it l.(”(l)ld in 1 SJ’5tPlN

of IWOIIIS ]]tilillt:~ilwd for St~lti Sti(’ill res(wrcl) or rel)orting pur-

[msm Only’mltl Ill)t Ilswl in Wlmlc 01’in ])ill’t in riding unv ddPl’-

nli]l~ltion ubollt :In idr]~tifid)l~’ illdivi(llinl. t’xcvl)t ils prov.i[lrrl by

se~’timl8 of titl(l 1:1:ttn(l

“(7) tll[, t[~rlll ‘rolltin{’ IMP. IIIP:IIIS.witlt rq)[u4 to t]I~I (]js-

(,10S111’(”(If il 1’(’(’01’(1. tllP tlSQof S11(’111’(1(+01’(1t’ol” :1 I) II I”])OSF wl)i(,ll

is (O(]]l)p:ltil)l(, \vitlt the ])llq;osv t’(If! wl)i(ll it !VilS {“oll~’cted.

‘>(b) (’OXI)l.I”I(IXS(JF ])ls(.I.OSCI{I.:. -S() :IXI’II(”Y S]lllll diW’]OSO ill)~

Iwor(l \vlli[ll is (mtninwi in :1systenl of rm’l)l”~lsby My lllPilllS of cOnltl~lltlicwti[)ll to Illly p(.1’S(Jll, 01’ t(l illl(Jt]l(’1’ il~Cll(’~. (’xce])t ])lll”sllunt to :1

writtrll Iwlurst hy, or \vit]] t]w [Jrior \vritt~’n consent of, the indivi(lll:tl

to WlIOIIItlm rIKKII.t[pt’rt:]i]ls, \Inl(Iss (Iisclosurth of tlw Iword wolll(l

I)(!-—

“ ( 1) to tllos(j dh’ers :Lnd em])l[)yrw of tllr :lgwwy whit]] mnilltni]ts tlIe ILWI{JrIl \vl Io lmve ;1 nwd for tile Iwy)t,fl in tlw performnncc

of tllcir dlltils:

“(2) Iwllliw,l ~l!tclerswtiml 5DJ2of this title:

‘.(:1) t’or o rotit lne wc m (Iolinwl in slllmctio]] (a) (7) of this

s(,[’tio]l :lIILl(Iwrilwd Imder sul]stwttio]l (c) (+) (D) of this section:

.. (-t) to tlw llIIIViIII of tlw f“/nsIIs for purpow of I)lilnuing (Ir

carrying ~)llt il (’(’11S11S 01’ Slil’V(’~ OI! ](~litted activity pll~st]il]]t to

tht> I)rovisiolls of title 13;

‘{(5) to u y>ri~,ient who l,ns l,rovi,le~] the ogen,y witl~ :dvti]l,e

Iuhquato wrlttoll :lssuranm that the rwtord will be used SO!(IIVw

a S(Ntist iml rmwt r(’h or report in~ row)rd. ond thrrwortlis t;) be

t.r}lnsft)rred in il fornl that IS not ]n[lil”icllullly idulltitiable;

“(6) tu tlm Nat iond Archives of the United States as a reeor(l

which IIM suticient historical or otlwr value to warrwlt its CInltinlwd preservation by the [Jnitd Stfites Goverm]ient. or for

t?wdlmtioll lJy the Adnlinistrtitor of (knerd Services (JI’ ilis

(1(’SIWIW to deteratine whether tIIe record IIM SUC]I v~]lle;

“~7) to mother ttgenq or to an i*Mrlu]le*ltality of any governnlentd jurisdiction within or under tile contd of the I“nitwl

Stlt4es for z civil or criminal law enforcement d ivity if the

nctivity is authorized by law, an(l if tlm IN3ad of the agency (II”

instrumental ity has mi-de x written rquest to the agency -which

37
maintains tile record specifying the particular port ion desirwl ill)ll

the ltw enforrenmnt activity for which the record is soug]lt:

“(8) to a person pursllant to a showing of compelling eircunlstances d’erting the health or safety of an individual if upon such

disclosure not itimticm is transmitted to the last known ad(lress of

such individual;

“ (9) to either House of (.”ongre?s, or. to the extent of matter

within its jurisdiction, any comnuttee or subronmlittec thereof’,

any joint committee of Confyess or Subconmlittee of any SIWII

joint cmnmitke;

“(10) to the (’comptroller General. or any of his autlmrize(l relb

resentrdives, in the course of the performance of the (Iuties of

the (ieneral Accounting Office; or

“(11) pursuant to the order of a court of competent juris(liction.

“(c) .kccovxm~(: OF ~ER’rAIN DISCLOSt-RES.-Edl agency, with

respect to each system of records under its control, shall—

“(1 ) except. for disclosures made uncler subsections (b) (1) or

(b) (2) of this section, keep an accurate accounting of—

“ (A) the date, nature. and purpose of each disclosure of

a record to anay person cm to another agency mule under

subsection (h) of this section: and

“ (B) the name and address of the person or agency to

whom the disclosure is made:

“ (!2) retain the accounting made under paragraph (1) of this

subsection for at least five years or the life of the record. whichever is longer! after the disclosure for which the accounting is

made:

“(3) except for disclosures made under subsection (b) (7) of

this sect ion, make the account ing made under paragraph (1) of

this subsection availab]e to the individual named in the record

at his request: and

“(4) inform any person or other agency about any correction

or notation of dispute made by the agency in accordance with

subsection (d) of this section of any record that has been clisclosed to the person or agency if an accounting of the disclosure

was made,

of ‘:::~r05$E:SJ TO ~WORI)S. —Each agency that maintains a system

—

“(1 ) upon request by a?ly individual to gain access to his

record or to any information pertaining to him which is contained in the system, permit him and upon his request, a person

of his own choosing to nccomprmy him, to review the record and

have a copy mude of all or anv ortion thereof in a form comprchensible to him, except that “?t ]e agency may require the individual to furnish a written statement authorizing discussion of

thnt individual’s record in the accompanying erson”s presenco:

$

u(2) ~ermit t]lc individl]nl to reqneet amen mentof~record

pertaining to him md-

(*(A) not latpr than 10 days (excluding Saturdays SUIIdays, and legnl pub]ic holidaye) after the date of rmipt. of

such request, aclmwledgc in writing euch receipt; and

“(B) promptly, either—

“ (i) mitk~ any correction of any portion thereof

which the individual believes is not accurate, relevant,

timely, or complete; or

“(ii) inform the individual of its refusal to amend

the record in accordance with his request.. the reason

for the refusal, the procedures esta~lished by the agency

for the individual to request a review of that refusal by

the head of the agency or an other designated b the

head of the agenc~, and the name and business aC/’dress

of that official; “‘

“ (3) permit the individual who clisagrees With the refusal of the

agency to amend his record to request a review of SUCh refusal,

!’ersonal

review,

Amendmnt

request.

Review.

38
Notation of

dispute.

Publioat ion

in Federal

Register.

and not later than 30 days (excluding Saturdays, Sunda.Ys, and

legal public holidays) from the date on which the individual

requests such review, complete such review and makea final

determination unless, for good cause shown? the head of the ?gency

extends such 30-day period; and if, after hM review, the rewewing

official also refuses to amend the record in accordance with the

request, permit the individual to file with the agencya concise

statement setting forth the reasons for his disagreement wit]] the

refusal of the agency, and notify the individual of the provisions

for judicial review of the reviewing otlicial’s determination under

subsection (g)(1) (A) of this section;

“(4) in any disclosure, containing information about wbjch

the individual has fileda statement of disagreenlent, CICC!II)rUIg

after the filing of the statement under paragraph (3) of this subsection, clearly note any portion of the record which is displlted

and provide copies of the statement and, if the agency deems it

appropriate, copies ofa concise statement of the reasons of the

agency for not making the amendments requested, to persons or

other ?gencies to whom the disputed record has been discl ose(i:

and

“(5) nothing in this section shall allow an individual access to

any information compiled in reasonable anticipation ofa civil

action or proceeding.

“(e) AGENCY Requirements.-~ach agency that maintains

a

system of records shal l—

“(1) maintain in its records only such information about an

individual as is relevant and necessary to accomplisha purpose of

the agency required to be accomplished by statute or by executive

order of the President; “ (2) coHect information to the greatest extent practicable

directly from the subject individual when the information may

result in adverse determinations about an individual’s rights, benefits, and privileges under Federal progr?ms;

“(3) reform each individual whom lt asks to supply information, on the form which it uses to collect the information or on

a

separate form that can be retained by the individualu(A) the authority (whether granted by statute, or by

executive order of the President) which authorizes the solicitation of the information and whether disclosure of such

information is mandatory or voluntary; “ (R) the prmclpal purpose or purposes for which the

information is intended to be used;

“(C) the routine uses which may be made of the information, as published pursuant to paragraph (4) (1)) of this

subsection: and “ (I)), the effects on him, if any, of not providing all or

an,y part of the requested information;

“(4) subjert to the provisions of paragraph (11) of this subsection, put-dish in the Feder:ll Register at least annually a notice

of the existence MI(I character of the system of records. which

notice shall includo-— u (A) the n~me and location of the system; “ (B), the ,categories of indiviciuals on whom records are

mttintamedm the system;

“(C) the categories of records maintained in the system; (~(~)) ~,tch rou~ille use of t,he records contained in the sYstem, incl ud~ng—the categories of users and the purpose of such

use;

“(E) the policies and practices of the agency regarding

storage, retrievability, access controls, retention, and disposal

of the records.;

“(F) the title and business address of the agency official

who is responsible for the system of records;.

“(G) the agency procedures whereby an Individual can he

notified at his reqtiest if the system of records containsa rvcord pertaining to him;

39
u (~1) the ~gency procedures whereby an indivickd can be

notified at his request how he can gain access to any record

pertaining to him contained in the system of records, and how

he can contest its content; and

“(I) the categories of sources of records in the syst~nl:

“(5) maintain all records which are used by the agency in making any determination about any indi~idual with such accuracy,

relevance, time]iness, and completeness ils is reasonably necessary

to assure fairness to the individual in the determination;

“(6) prior to disseminating any record about tin individual to

any person other than an agency , UI1lWSthe dissemination is

made pursuant to subsection (b) (2) of this section, make reasonable efforts to assure that such records are accurate, complete,

timely, and relevant for agency purposes:

“(7) maintain no record describing how any individual exercises rights guaranteed by the First. Amendment unless expresslyauthorized by statute or by the individual about whom the record

is maintained or unless pertinent to and within the scope of an

authorized 1aw enf orcemcnt act ivity;

“(8,) make reasonable efforts to serve notice on an individual

when any recorcl on such inrli~idual is made available to my person under cmnpulsor.v legal process when suc’h process bwomes a

matter of public record;

“ (9) establish rules of conduct for persons involved in the Rules of

clcsiem, development., o~mration, or mitinten~llcc of any system of conduct.

records, or in nmintainmg any record, and instruct pil~h sycb person with resprct to such rules nnd the requircm-mts of this sertion,

including aJIy other rub’s and procedures adopted pursuant to this

section and the prnalties for noncompliance:

“(10) establish appropriate ndminist mtive, technical, and Conf identicality

physical safrgunr{ls to insnre the security and confidelltia]ity of of records.

records and to protect ngainst any nnticipate(l tbrmts or }lazards

to their security or integrity which could rwllt in substrmtial

harm, embarrassment, inconvenience, or unfairness to any inriividual on whom information is maintained: and

“(] 1) at ]rmst ~fl dfiys prior to pub]irat ion of informat ion under ;ublicat.ion

paragraph (-!) (J)) of this subswtion. publish in the Ihdw:ll ‘-n Federal

IiegiNer notice of any new US(?or intended use of t]w inform:ltion ~fwiSter.

in thq system, and provide nn opportunity for intmestw-1 persons to

submit written data, vimvs. or argunwnts to the agenry.

“ ff ) AGESCY Rm,m.-In order to carry ont tho provisions of this

section. carh ajgcmcy that maintains a sysstem of records slm] I promulgate rules, m accordance with the rcqulremfmts (including general

notwe) of section 553 of this title, which shnll- 5 !’SC 553.

‘t(1) establish procedures wherebv i~n inr?i~idnal con be notified

@ rwlxmse to his request if my s~stem of records mtmerl by tho

llldividua I vontnins a record pertaining to him;

“(2) dvfine reasonable times, places, and requirements for identi l’yil~g Im individual who requests his record or information

pertaining to him before the agency shall muke the record m

,Iliorlllatmn available to the imhvi(lual,;

O*(:1 wtublish procedtuws for the dmclosure to an individual

!Ipon 1!is request. of his record or information pertaining to him,

lnrlll(llllg special prowdure, it’ dcttmed nertwsnry, for thv disrlosurc to an imlividual of medical records, including psychological

rerords, ]x~rtaining to him;

“ (4) establish procedures for reviewing a request from an

individutd concerning the amemimcmt of mny record or information prrtnining to the individual, for muking a determination on

the request, for on appeal within the agency of an initial adverse

Ugellvy (Ieterll\illlltioll. and for whatever additional means nyl,y be

necessary for each individual to be able to exercise fully his rights

under tills swtion: aml

“(J ) cstabhsh fees to be charged, if any, to any individual for Fees.

-nnikhg copks of his record, excluding the cost of any search for

aml review of the record.

40
Publication

in Federal

Regieter.

Jurisdiction.

Atnen?hnent

of reaord.

Injunc?, i9r,.

The (Mice of the ~edera] I{egister shall unnunlly compile and publish

the rules ]Jron]ulgated unchw this sulmction and agency notices puhIished tt]ltl~]’sll~sectioll (e)(4) of this swtion in a form avnilahle to

the public at low cost.

“(g),! 1) ~lvJL l~~JIEDIEs.—Wh$never any a~y

{.~) nlakesadeterll~lnatlon unckwsu section (d)(3) of this

sert]on not to amend an inclivi~ua17s record in accordance with

his rcquest,o rfailstomakesuch review unconformity withthnt

subsection ;“

“(B) refuses tocol]]p]y withan indivicluol request mldcrsuhsection (d)(1) of this section;

“(C) fuilsto m[ti]~ain anyrecord concerning anyindividlltll

with surh accuracy, relevance, timeliness, and completeness as is

necessary to assure fuirness in any determination relatimgto the

qualifications, charticter, rights, or opportunities of, or benefits to

t}m individual that ma.ybemade o]lthe basis of such record, and

consequcntly”a determmat.ion is made which is adverse to the

individual: or

“(D) fails tocomldv witllanv otllerprovisionof this section, .

or nny” rule pronlul~aied therelmder, in such

a way as to have

an adverse effect on an individual,.

the in(lividm~l may bringa civil aet]on against the ?gency, and the

district courts of the United States shall have jur]sdict~on in the

matters under the provisions of this suhsect.io]i.

“(2)(.4) In any suit brought underthe provisions of subsection

(g)fl){.~) of this section, thecourtm ayordert heagencytoa mend

the ]ndlmdual’s record in accordance with his request orm such other

way as the oourt may direct. In such

a (.ase the court shall determine

the n)iitter (le novo.

“(B) ‘I’he courtmayassess against the ITnited States reasonable

attorney fees and other litigation costs reasonab]yi ncurredin an.y case

under this paragraph in which the complainant has substantially

nrevailed. L “(3)(A) In anysu~t brought underth eprovisionsof subsection

(g) (1) (13) of this section, the court may enjoin the agency from withholding the, records and order the production to the complainant of any

agency records improperly withheld from him. In sucha case the court

shall determine the matter de novo, and may exmmine t}le contents of

any ilgCIl(’~ records in ca]IIOrm to (letcrrnine wll(, tlwr tlw r(mr(ls or any

porti(m tlwr(mf may he witllh(~l(l umlcr any of tlw (:xenlpti(,ns sot forttl

in suhsedi(m (k) of this section, and tlm Imrden is on t}w ng[.llcy to

sustain its action. “ (13) ‘Il)e rwllrt ])]it~ :ISSrSS against.

t 11PITnitwl States rro,solliibl(:

.,

tlt t.orncy f(W and ot ]I(,r

1It l~rnt.ion costs r(,:(s(j]l;ll)ly incllrrcd ill any (!ilS(>

under this paragraph in which the ~nn)])lili])~nt has sul)st:uitially

l)rcvailed.-‘“

-“ (4) In nny suit I)rougl)t UII(l(,r tl]o I,r(wisions of sl]bswtion . . . .

(g) (1) (C) or (1)) of tl]is swtion in wh]rh the rourt dvtorm]ne.s tli:lt t 11(}iI~(!ll(”y il(’t(t(l in :1 111:111 ])(,1’wl]irl) Iv:ls illt(~ntion:ll or will ftll, tllc

Ilnitwl States sl]:lll lw Ii:lh]e to thv indi\i(llml in iln nnlollnt cqlml to

the sum of-

“(A) a(’t]l:ll (lanmgcs sustai]ied })y tl~(, i]l[lividual :]s

n rcslllt of

tile r[>t’llsnl or fililllro, IJlit ill lln t,:lse s]]:]]]a ~wrson ontitlml to

rwofwry rw(,ivr less th:il) tl](, SIIIII of $1.()[)(): ml “ (1;) tll(> costs of tl)e action tojytlwr with ].iiiso])iit)l~ attornry

t’~(++ilS det[,r]tli]lrfl I)yt 11(,[YJlllt.

“ (~) ,\ll ildi(?ll to (~lIfl)l’fT> S])Y li~hi]itj’ (’l”WIIC’(]llll(lO?” t}liS SWtiOll

]Ilny I)e l)rolIglIt II] tl]c {Ilstrl<+ r.:)(lrt of tile I’nitv[] ,Stntcw in t}lp (list] i(,t

in wl)irh tllo (T)lllI)l:lillilllt wsi(l(w. or has his prinripnt plncp of l)llsinws.

or in whirl) t})? ag(~ncy rwor(ls ill’e sitll:ltwl, or in the l)ist ri{t of CO1umI)is. witllollt rvganl to tll(, :l]l](~l[]lt in (,{]]]tr(~vprsy, ,vit]]i]] t,ro yWII-S

t’r(mI $P (Iatr 011 whirh tllc raww of arti(m :Iris(ls. rx(,ol]t tllnt wh(IrcI

ill) il#Il(”~ lliIS mi~t~,ri:l!l,v :111(1\vill fllll,v ]]li.].(,]jl.(.s(.]11p(l :Il;y i])form:ltiOIl IW[llll”(i(l Il])(k.r this S(l(btiO]lto lJC dk(,loSd t{) :11) ill(]l\’i(]ll:ll 211(]

tll(> itlfornult ion so ]Ilisl[,])t,(ls(,llt(,(l is lll$lt(>l$iill to (Still) li>l)ll)(Lllt of

tll(>. li:lbility of tilt, :iwnPv to tll(. in(livitlll:ll I]jlfl,.,. tl]i+ s(,(tif}l), tl][.

41
:i[”t iol) II)il.v I)(I l)ll)ll,gl]t :11 :11)~

f i]tlc \vit]Iif]t \yo~Pill,S :[f’fe]. l]iw,oyer~ }Ir

tlke in[livitlli:ll ~~t’tl}e ll!ist.(.l)r[.st,~lt:ttif~ll. X[)tll{ng ill ll~is se,.tit)!: :sII:II]

Iw [.onst rIII,(l to allrl)orizu :l,ny civil actiml I,y r(,as(m ot’ nny il]jilry SIIStainril as tile res!l]t (Jf ii (Iis{,losltt’e of a rt,(,or(l ]Jrior to tile [.l~w”tiv[,[I:ltr

of this scctim.

‘$(11) Iili;IIrs ,)F IJt.x;.\I,(;t”.\l{I)l.\ss.–l+’~)l tll{, l,[lrlms(>s f)f’t}lis s,vtic,),,

[11P parent of ally nlinor. or tllr Ioxll glulr[li:ln of illl~ Ill{livi[l[l:l] \VJIII

ll:W I)(,(ill (IPO1:l I’P(I to I)(, illcol]l]wtcllt (111{}to ]J1l.ysit,:ll or IIi[,lltiil ill[.:[-

!mcity or ~L<(,lj~ il {{1111.tOf (.OIll])i,tt>llt j[irisdictlnn. lllil~ :Irt 1)11 I)(,I]:LI

f

of tlw in(llvl(lilal. “ (i) (1) CI{lMIX.\14 l) EX$I,TIM,-AIIY OtliC(>t’ ot” l?lTIIllO~(T Of illl

a~wll(’.v, Jvho by virtm, of 111S[,lllplo,vnlent or ofiicia] position, ]l:Is 1)0s.

scssirm of, or amwst0, :Igeny reronls whirh contain in(li rifllml 1)

idcntititiblc information the disclosure of which is ptwhihitwl hv tills

section or by rulw or rrglllati~)ns (’StiIl)liSll[>(l tlwrellndcr, :Itltl wlIo

lmowix!g thnt (lisclosllrt~ of the speciiic nlatcri:ll is so prohihilt,tl< willfully (Ilscloses the ]nateriai in :iny. tnanner tojmy persw] or agency not

ent]tlt>(l to rcc[,i\c It, sl)ali lw guilty ofa nllsde]ncanor and fined not

Illow than $.-),()[)().

“(2) -~11.l’ (Jfli~’(’!’ 01” ~’jll])lo>(’t” of ~111~il~(’11(’~ \VIlowill flllly Ill:lilltilills

a systenl of lerotxk \vltllout nm,tln~r th(, notic, l“tl[lllil.t,t])(,tlts(It’ SIIIIse~,iiol~(e) (4) of this sedion sl];~ll be guilty of n n]idenl(mnor illl(l fint,(i

1101 nl(-)t’[, than $,1,()()(). “ (3) .illy peIWII who Ijl]f)yi!]gly :In(l will filli~tqlwsts or ol)t:lius

:Ul~ XX,(’olh(l u~]l{vr]li]l~r :111 111(11V1(III:L1 fWIl) illl :i~rt~tyy Illl(j(,r t’illS(l lJlTt(’llS(’S Shall k guil:y Of a Illis(l(}Itl(,:ltlc)r Slld filled llOt II)orv tlliltl $.-,.()()().

“(j) (i ExEl{.\rJ k.xE3rl’’r10ss.-:rll(~ h(wd of any :Igenc-y may pronllllgat(., rules, ill :WCOIKI:LIIWwith tile reqllirmwnts ( includin~r &lll[l~ ill

]loti(w?) of sections 5Z) (1}) (,1), (!2). itIld (3), (C). :In(l (e) of tills titlt>,5 “s- 552.

t.o exrllll]t ally systw!l of Ivcotlls !\it hit) tlw ii~[’llC~ from any p:~rt ot’

this scrtion Cxce])t sllbsections (1)), (c)( 1) and(2), (c) (4) (+~) [Ilrougll

(F), (c) (~), (7), (~), (10), and (n), and (i) if thesystemof records is_

“(I) maintained by the Central Intelligence Agency; or

“ (2) ]naintained by an agency or component thereof which

performs as its principzl function any acti~ity pertaining to the

ellfowen:ent of criminal laws, including pollee efforts to prevent,

control, or rw{uce crime or to apprehend criminal?, and the activities of prosecutors: courts, correctional, probat]on, pardon, or

parole authorities, :Lncl whIc]I consists of (A) information compile(l for the pllrpose of identifying individual criminal otl’enders

and alleged offenders and consisting only of iclentif ying clata

and ]Iotations of arrests. the natui,e and disposition of criminal

charges, sentencing, confinement, liele~se, and parole and probation stat us; (11) information compiled for the purpose of

a

crirnintil. investigation, including reports of informants and

invest igators,. and associated with nn identifiable individual; or

(C) repprts ]clentifiable to an individual compiled at any stage

of the process of enforcement of the criminal lilWS from arrest

or in(lict.n]ent through release frotn supervision.

.kt the time rules are adopted under this subsection, the agency shall

include in the statement required under section 553(c) of this title,

5 “m 553.

the reasons why the system of records is to be exempted froma provision of this section. “ (k) f$I>I?(>IFI(; ~XEMP’1’IONS.—’h2 head of any ~gency may promulgate rules, in accordance with the requirements (mchrding general

notice) of sections 553(b) (1), (2), and (3), (c), and (e) of this title,

to exempt. ally system of records within the agenq from subsections

(c) (3), (d). (e) (l), (e) (4) (G), (H), nnd (I) and (f) of this section if the system of records is—

“(1) sllbject to the provisions of section .!i52(b) (1) of this title;5 “’SC 552.

u9 in~esti~atory material compiled for law enfcmcemmt purpos$s,)other than mmterial within the scope of subsection (j) (2)

of this section: Z>7,0v{dd, ho?oever. That if any indivirlnal is

(lenied an.v right., privilege, or benefit that Ile wonkl otherwise

he entitled by Federal law, or for ,which he would otherwise ho

42
eligible, as

a result of the nwiutenrrrwe of such material, such

material Sha]l bc provided to surh infli vidua], exrc?pt to t.hc extent.

that tlm [disclosure of si~i~ll matrrial would reveal the identity of a source who furnished infornlation to the GoYernnlmlt under an

express promise that the identity of the source would be helrl in

confidence. or, prior to the. ell’ectivedate of this section under

an implied promise th:lt. the identity of the source would ke held

in confidence;

“(3) maintained inconllertiorl with providing protective services to the I%sidcnt of the United States or other individuals

12 Lfs(!3056. pursuant to stiWien 3056 of

Iit]e 18;

I~(q) re(lllir[,d I)Y statllte to be maintained and used solely as

statistical rec,ords~

“(5) investlgt~tc)r~ n~aterial ooInpiled solely fortlle purpose of

det('rn]ining sllitttb]lity,e ligibility,o t'{[llalificntiolls for Federal

civilian employment, military service, Federal contracts, or

access to classdied information, but only to the extent that the

disclosure of swh material would reveal tbcidentityof asonrce

who furnished in fornlati(}ll to the Govermnent ~lnder an express

promise tlmt the identity of thcsourc ewouldbeheld inconfidcncr+, or, prior to the eflect.ive date of this section, under an

illipllcd promiw’ tlmt the iclwtity of the source would beheld in

confidence;

IL(6) tostirlg ~l. (>xarllirlatiol~ material used solely to,determine

,indi’vidual qualificotiom for appointment ?r promotion in the

Federal ser~ire the disclosllre of which would compromise the

objectivit.~ or fairness of the testing or examination process; or

“(7) cv~~llIatio]~n]itterial used todeterr]linc potential for promotion in the armed services, but only to the extent that the

disciosllreof such material }votlld rcv(’al tl]eide]]tityof resource

who furmishrx-i information tu tl]e Government under an express

promise that the identity of the source would be held in confidence, or, prior to the effective date of this section. under an

implied promise that the identit.v of the source would be held in

5 Usc 553.

confidence.

At the t@c I*U1USare adopted lmrlrr this snbsertioil. the agenc,y shall

inelndt> In the statement. rvqliircd under swtion 55:3 (c) of th]s title,

tlm reasons WII,Vthesystwll of rwrmls istrr Iwexenlpted froma provision of this section.

“(1)(1) .4rt(']lIv.\I, Ii]}({~]tlJs.-l~;t\('ll/lg('t\('vr ccf)rtl\ vllicl~isaecepted

l)y the Mm inist rat or of’ (;wwral Hcrvirvs fir storage, processing, and

44 USC 3103. servicing in arcordrtncw with section :llo:30fti tle44sI]nll,

” for the purposes of this swtion, be ronsith~red to be maintained by the agency

whirh deposited the record and Sl)itll I.XI subject to the provisions of

this sectirm. The .I(lr]li]listl”:ltolo{)f GPnl’r’ill Srrvicessl]alt not disclose

tho record cwrpt to tile agency whic]l nl:lintainsthe rvcord.orunrkr

rules established by thrtt agency which art’ not inconsistmt with the

provisions of this section.

“(2) Each agency record pert:liningto rrn identifiable individual

which was transfermdto the National Archivesof the United States

as

a record which hrts sufficient historicrtl or other value to warrant

its continued preservation bt~ the United States Government, prior to

the effective date of this section, shall, for the purposes of this section,

lx! w)]lsi(lt~rwl to Iw nmintained by t]w National .irchives and shall

Publication not besubjert to the provisionsof tllisse(’tioll, ex(’e])ttllmt ast.atement

in Federal

Register.

&Jl~Vitll.V deswil)ing sm.]] recor(ls (mmlele(l after the requirements

rehlting.to mrmxls subject to sllbsections (e)(4)(A) thr’ol@] ((+) of

this section) shall be published in the Federal Register. “ (3) Each agency record pertaining to W) ldentifii~ble individual

which is tumsferred to the N~tional Archives of the United States as w record which hilS wffirient historical or other value to warrtint its

continued preservation by the ITnited States Government, on or after

the effecti~e date of this section, shall, for the purposes of this section,

IICconsidered to be maintained by the National Archives and shall be

wwmpt from the.requirements of this seetion except subsections (e) (4)

(A) tllrol@~ ((i) and (e) (9) of this section.

43
“ (In) GOWRNMI.XT CONTRACTORS.—WhWI an agency pravidw by a

contrnct for the operation by or on behalf of the a~wncy of a system

of records to uwomplish an agency function, the agency shall! consistent. with its authority, cause the requirements of this section to bc

mpplied to such system. For purposrs of subsection (i) of this section

nny such co]ltractor and any emplowe of swh contractor. it’ such

rent ract. is agreed to on or after the e~ect ive date of this section, shall

be considered to be an employee of an agency.

“ (n) hf.mmw I.ws.-An individual’s name nnd address may not

be sold or rent ed ~y an agwmy unless such action is specifically authorized by law. ‘1’lIK+provision shall not be construed to require the

withholding of names and addresses otherwiso permitted to be made

public.

“ (o) Rwowr (m Nmv ~wrwM.-Enrh :Igency slmll providv :,dwpu,tv w icP tO

advance notice to Congress and the (Mice of MauugenwIIt and Illdgvt C!cmyess arc!

of m]y proposal to wtabl ish or alter any system of records in order Op:s.

to permit an evaluation of the prob:lble or ]mtentia] effect of such

proposal on the prlvary :md other personal or property rights of

individuals or the disclosure of information relating to such individuals, and its eti’ect on the preservation of the constitutional

principles of hxlcralism and separation of powers.

Report to “ (p) ANSGAX.lbxwrr.-’~hc President shall submit to the ~peaker

Speaker of of the House aml the President of the Senate, }y June 30 of each

the House calendar ~vcar, a consolidatmi report, separately llsting for each I~edend President of the eral agency the number of records contained in any system of records

Senate. which were cxenlpted i’rom tl]e applic:ttion of this section under the

provisions of sul)sections (j) and (k) of this seution during the preceding calendar year. and t.lle reasons for the exemptions, and such

other infor]lmtion as indicates eii’orts to administer fully this section,

(q) EIT~(vr o? omr~u Id.\ws.—X? agency sh:ll rely on any exemp5 USC 552. t.ion contained 111scet Ion 5YJ of this tltlc to w]thholcl from an individual any record which is otherwise accessible to such individual

under the provisions o f this section.”.

44
APPENDIX II

RULES AND REGULATIONS CONCERNING

CONFIDENTIALITY: HEALTH CARE FINANCING

ADMINISTRATION

[4110-3s1

lilla 42-Public Hmlth

CHAPTER IV-HEAL7N CAUEHNANCINGAD.

A!INIS7RA710N, OEPAKTMEN1 OF HEALIH,

EOUCA7t0N, ANO WELFARE

WECNA?TCE O-? ROfESnONAL S7AN0AXOS

Uvllw

PAM 474-CONF10ENnAU7Y ANO OISCLO.

SURE OF INFORMAIIOH BY PROFESSIONAL

STANOARDS REVIEW0RGANIU110N5

AGENCY: Heaith Care Financing Ad.

ministration ( HCFA). HEW.

ACTION; Final rule.

SUhfMARY This rule sets forth poli.

ties for disclosure of information ac.

stuired by Professional Standards

Review Organizations (PSROS). Sec.

tion l166(a) of the Social Security Act

rertuires reSUlatiOnS for the release of

FSRO information for other than the

purposes of the PSRO statute. The

Intent is that PSRO Information

which was previously pubiished or is

in agsrexate statistical form be cmovider-to ‘parties who need it, without

violating the irrivacy ritrhta of patients

artd heafth care fsractitionem and

without undue burden. Observance of

the rule Is intended also to protect

PSROS againat the risk of penaities

under section 1166(b) of the Act.

EX%XT’fVE DATE These reaulatlons are effective on January 16, 1978.

FOR FURTHER INFORMATION

CONTACC

Lois Eberhard. 301-443-2808.

SUPPLEMENTARY INFORMATION

BACKGROUND

PSROS review .Medicare. Medicaid

and Matemai and Child Health and

Crippled Chiidrena’ services. Some of

the information actruired by PSROS in

carryine out the review functions are

of 3“ sefiitive or personal nature, re.

quirtne stringent safeguards. Other in.

formation is public in nature prtor to

receipt by the PSRO or in the form of

statistical summaries that do not iden.

tify individuals. PSRO information

can be uaefui to other parties. These

regulations are necessary to provide

for the reieaae of information without

subjecting PSRO personnel to the risk

of penatties under section l166(b) of

the Act.

The notice of proposed rulemaking

published on December 3, 1976 (41 FR

53215), cDdified these policies under

Subpart Q of Part101 of Title 42. of

the Code of Federai Reeuiations. I

Regulations effective October 1.

1977 established a new Chapter IV in

Title 42 of the CFR and transferred

all Health Care Financing Administration resuiatiorrs to that new chapter.

Accordingly. these final reaulatiorrs

are codified under 42 CFR Part 476.

DISCUSSIONOF COMMSNTS

Comments, suggestions and objet.

tions received in response to the December proposal were considered and

are scunrrrariaed below along with our

responses thereto and the changss in

the proposed rule.

1. Proposal is too narrow. Seveml

comments objected to the publication

of an interim regulation providing

only for limited disclosure and advo.

cated the immediate develo~ment and

issuance of a comprehensive regulation. The majority of these commens

recommended much broader disclosure to meet the needs of the public

for more information on heaith providers and services. but still protect

the privacy rights of patients How.

ever. re3Ui2.tiOCIathat pernrit the disclosure of comparatively nonsensitive

and public information can be published sooner. It takes time to resolve

the broader. more complex issues that

underlie a comprehensive regulation.

Suggestions that are pertinent to

these issues are currentiy being considered in developing the comprehen.

sive regulation.

2. Additional disclosure under the in.

terim recrrdation. It W= recommended

that the proposed rule be expanded to

include the disclosure of the norms,

criteria and standards used by the

PSRO and data coliected soleiy for

PSRO purposes, such as the number

of days certified and Medical Care

Evaluation Studies. The Secretary ha+

determined that disclosure of PSRO

norms, criteria and standards is per.

mi=ible under section l166(a)( 1) of

the act without regulations. Data coilected solely for PSRO purposes is

beyond the scope of the interim Nle.

However, the comprehensive regulation under development will reflect

this recommendation.

3. Disclosure on PSRO’s own inifiafive The proposed ruie required

PSROS to disclose specified types of

data or information only upon receipt

of a request. Severai commenrs sug.

gesced that PSROS also be permitted

to disclose the same rkta or informs.

tion on their own initiative. when appropriate. This suggestion has been accepted and included in the finai rule.

4. Burden on PSROS. Several comUEenf.Sextwessed concern chat the implementation of this interim reauiation wouid place an excessive burden

on PSROS to provide data services. It

is recognised that the provSsion of

data by PSROS will piaee a burden on

some PSROS. Nevertheless it is considered important that such data. heretofore inaccessible in many geographic

areas be readily avaiiabie to health

agencies and the public. This ap.

preach will make it unnecessary for

those agencies to duplicate the collection and processing efforts of the

PSRO. Moreover. by requiring that m.

quests cleariy define the data or information desired and by Permitting the

PSRO to charge a fee for data or in

formation not routinely CDmPiled fOr

PSRO use, it IS expected that the

burden will be eased somewhat.

The Interim regulation does not require a PSRO to automatically meet

all requssts for data or inf orrnatiorx

rather it requires the PSRO to exercise judgment regarding the condftiorrs of disclosure. These conditions

involve matters such sc the asswartce

that individual are not indirectly

identified in the data or information

to be disclosed. However, in recogrtition of the need w establish a procedure for review of a PSRO decision to

deny a request for data or information, the interim regulation has been

amended to provide for Secretarial

review of such denials.

5. Cora/identiality determined by

source of tr%mrafion. A number of respondents understood that $476.2

would permit the source of pubiic in.

formation to determine that such information waa confidential. even after

it had been published. and thus prevent its disclosure by the PSROS.

Since it was not the intent of the prevision to permit sources to so controi

the data. the rule haa been clarified.

The purpose of the rule is to require

disclosure of data or infornration

which was published prior to receipt

by the FBRO. Examples of this type

of data or information are newspape.

articles and annuai reports of heaith

care institutions which are publicly

distributed by the institutions

6. Sfatisfics identify health care institutions. The proposed rule provided

for the disclosure of summary statfatics ‘M long ss neither patienta nor

health care praetittoners could be

identified through these summaries. A

number of commen~ objected to this

rule. because it permits the disclosure

of data or information which identify

health care inat~tutiorre. It is the intention of the Department to make

such in.stltutiorrzi “data available to

meet a variety of needs for health

data, including identification of probiem are=. heaIth Xanmn!r and the

funding of health services. The disclosure of data about identifiable irsstitutions is also consistent with court deciS1OCISthat have heid that institutions

have no right of Prfvacy under the

Constitution, U.S. v. Morton SalL 338

U.S. 6S2. 70 S.Ct. 357 (1950) and with

section 1106(d) of the Act, which requirss that various Medicare contrac.

tor performance reports. provider evaluation reporrs and provider survey re.

ports be availabie for public ir-spec.

tion.

On the other hand. the Secretary is

mindful that such itrstitutionai infer.

macion may be misinterpreted in thabsence of an appropriate context. AC

cordingiy. the proposed regulation

provides institutions with an oPPortu45
nity to comment and requires PSROS

to forward Lhose comments to the recipient of the data or information in

order’ to correct errors or inaccurate

impressions.

7. Use 01 computer tape. Several

comments suggested that PSROS be

permitted to provide UHDDS data or

information on computer tape as well

as in the form of aggregate statistics.

The Department recognizes that the

disclosure of UHDDS computer tapes

wtth personal identifiers deleted may

make the data more useful to some

users and reduce the burden on

PSROS. However. techniques do not

exist for determining if an individual

couId be identified from the data on

the tarre. Therefore. the Defrartment

h= rejected the suggestion Until such

techniques for asauring the privacy of

individuals are available.

8. Disclosure on basis of need to

krcorc. IL wws suggested that the rule

be revised to permit a PSRO to disclose information if the PSRO deter.

tSIineS that. the requesting party has

an appropriate need to know the data.

This approach would be broader than

the criteria for disclosure set out

under section 1166 of the Act, which

permits disclosure of PSRO data only

if it is necessary to carry out the purposes of title XI. part B of the act or if

such disclosure has been determined

by the Secretary to be appropriate and

la specified in regulations.

9. Availability to State Govemmerck.

A number of States urged that all

PSRO data or information be available to State Governments It is the

position of the Department that a

great deal of PSRO data is available to

State hfedicaid agencies presently,

even in the absence of regulations.

The States are now authorized by the

Secretary to monitor PSRO activities

and may obtain certain data to do so.

PSRO data necessary to make Medic.

aid payments must be dk.closed to

Slate Medicaid agencies under section

1158 of the act. Also, data or information for other activities necessary for a

State Medicaid agency to carry out the

purposes of Utle XI, part B of the act

can be disclosed to States under section 1166(a) without regulations. Fi.

nally. the comprehensive regulations

under development are expected to

provide for further disclosure of

PSRO data or information to State

agencies.

10. Waiver of NOI. Several commentem objected to the publication of

a Notice of Proposed Rulemaking

without publishing a Notice of Intent

beforehand, and maintained that the

regulatory policies of the Department

(40 PR 34811) were not followed.

While the regulatory policies of the

Department encourage the use of the

NOI, they do not require the Publication of an NOI in every case. As seated

in the preamble to the proposed rule,

the proposed rule was published without the uee of a Notice of Intent \NOI)

‘“because there is an urgent require.

Merit for these regulations and over an

extended period of time there hac

been signific~t interaction between

the Department and medical and con.

sumer organiaatiorrs and interested in.

dividuafs in the development of the

apProach contained in the NPRM

which has satisffed the spirit and

Intent of the NOI.”

11. Pubficfae existence of PSRO data.

It was urged that the public should be

informed of the existence of the

PSRO data system. No revision in the

present regulation wss needed since

each PSRO is required, under its contract with the Department, to publish

a notice of the existence, scope and

purposes of the PSRO data system.

12. Obtain jrrcblic irtfonnation Jrom

0ri9inUf source. Comment was received

suggesting that PSROS refer requests

for public information to the source of

the information. rather than furnish

It themselves. Thfs suggestion was rejected because such referrals might

often be time consuming and onerous,

thereby making it more difficult for

persons to obtain a large variety of

useful public data.

13. Applicability of the PriuacY Ac~

Comments were received suezestine

that the “Privacy Act of l~yc (~

U.S.C. 552a) was aDulicable to PSROS

and the provisions- of that Act should

be reflected 1ssPSRO confidentiality

regulations. It is the Department’s

view that section (m) of 5 U.S.C.

552(a), which makes the Privacy Act

applicable to government contractors

whose contract Drovides for the ouer.

ation of a system of records on behalf

01 a government agency. does not

aPPIY to PSRO contractor. PSROS

collect data m-fmarfly to carry out mrPosris specified by statute .%s‘PSRO responsibilities. not the responsibility of

the Secretary, and each PSRO directly

manages its own review operations and

the records collected for such purposes.

14. Time. fimit on interim rcgufa.

lions. It was proposed by some tom.

reenters that a limit be set on the

length of time that the Interim regula.

tions sre in effect, to assure that corn.

prehensive regulations are published

ss quickly as possible. It la the lnten.

tion of the Department to publish

comprehensive regulations on PSRO

confidentiality as quickly as the out.

standing policy issues are resolved and

the procedures neces.ary for publication of regu1ation6 are completed.

However, since this time period IS very

difficult to predict, it was decided that

the interim regulations should not

have a limit on the time for which

they are effective.

15. Determining whether data identi.

Ife$ individuals. Comments asked

what particular method would be used

In determining whether individual patlers~ or practitioners were ,’identifiable” from the PSRO data to be dLsclosed. Of particular concern is the in.

direct identification of individuals

through a combination of attributes

such as sex, age, dates of admission or

discharge. diagnosis or procedures,

Such “identifiable” data would not be

required to be disclosed under the hr.

terfm regulations. Since statfatical

techniques for impl!cit Identification

of individuals from statistical lnf orma.

tion are highly technical In nature and

vary with the type of data involved, it

was not feasible to specify such mech.

oda in the regulations. HEW will Issue

guidelines which will be provided to

PSROS on this subjecc to suggest

methods whereby statistical data can

be displayed to avoid the identification

of individuals. ..

16. No regulation untif alf PSROS

are in full operation One comment

suggested that the proposed regulation be withdrawn until all PSROS are

fuily operational. To restricc the use

of data or information acquired by

?SROS until such time as all PSROS

are fully operational would conflict

with the intent of the DeDUtIfSent to

meet the current needs of”man y users

of health data.

17. Information on ezfstence and

cfmsificatiorr of data Some comments

asked that the regulation establish a

practical procedure to inform Individ.

uals of the types of information available and the manner in which the infortnation is labeled by the PSRO.

Since the disclosures. except for previ.

OUSIYpublished information. required

under the interim regulation are limit.

ed to data available only from the

UHDDS. there should be little confu.

sion over the specific data s.vailsble

from this source, In addition, the Sec.

retary believes it would be too great a

burden on PSROS to require all

PSROS to publish regularly a descrlp.

tion of all the previously publlshed

dat3 which it has acquired. 42 CPR

Chaauter IV. Subchapter D. is amended by”adding a new Part 476 to read as

follows

sec.

476.1 ,4pplicabillty.

476.2 Disclosure of publlc hrformatlon le.

quired by ?SROS.

476.3 Disclosure of Uniform Hospital Dis.

charge Data Set acquwed!’JYa PSRO.

476.4 Secretmial Review,

AUTHORXW Sec. 1166.Social Security Act,

S6 Stat. 1443 (42 U.S.C. 1320C-15fi section

1102 of the Social SecurIt y Act. 49Stat. 647,

as amended142U.S.C.1S02).

j 476.1 Applicability.

The provisions of this part are appli.

cable to the disclosure of Information

acquired by a PSRO in the exercise of

its duties and functions under the

Social Security Act in accordance with

section 1166of the Act.

46
$416.2 Disclosure O( public information

acquired by PSR6%.

(a) A PSRO shall, upon receipt of a

request for specific htformation in Its

Doeseeslon, provide to the person

making the request a COPY of that in.

formation lC

(1) The information had, prior to

the request. been published or otherwise d{sclosed to the public by any individual or ecstlty other than the

PSRO or he emplpyees, members or

directors, and

(2) The disclosure of the information Is not prohibited by Federal or

State law.

(b) A PSRO may, on its own htitla.

We, provide to a person whom it determines to have an appropriate need

for such Information. a COPY of anY information described In paraera~h (a)

of this section.

(c) Information provided under this

section shall be In the form in which it

is received by the PSRO or in the

fores In which it Is maintained for

PSRO use.

(d) The PSRO may require the payment of a fee. for furnishing infocma.

tion under this section. not to exceed

the reasonable cost of doing so.

$476.3 Dkclonure of L’niform f{ospital

Discharge Dsta Set ( UHDf)Sl acquired

by ● PSRO.

(a) A PSRO shail. upon receiPt of a

request th6t cieariy defines the specific information desired. provide to the

person making the request, summary

statistics derived from the Uniform

Hospital Discharge Data Set (the

multi-purisose. basic data set containing information on a hospitai discharge approved by the Secretary for

use in Federal health programs. inciud[ne the PSRO program) which

does not directly or indirectly identify

a Particular patient or health care

practitioner.

(b) A PSRO may provide to a person

whom it determines to have an appropriate need for it, summary statisti=

acquired by the PSRO from the

UHDDS which does not directiy or in.

directiy identify a particular patient

or heatth care faractitioner.

(c) Information described in paragraphs (a) and (b) of this section, if

routinely comc)iled for PSRO use.

shall be ‘provided without charge.

(d) The PSRO may require the payment of a fee for furnishing information under this section. not to exceed

the re=onable cost of doing so.

(e) If information provided under

this section identifies a particular

health care institution, the PSRO

shall notify the institution, at iea$t 15

days before disclosing the information.

of its intention to do so. The identified

health care institution may submit to

the PSRO comments concerning the

information to be disclosed. which

shaIl be attached bY the PSRO to such

information if received prior to its disclosure or forwarded separately by the

PSRO to the recipient, [f the corn.

ments are received after the inforcnation w= disciosed.

(f) The PSRO may attach a statement of comment to any c!isciosure

made under this section.

5 476A Secretarial review.

Any person whose request for infer.

mation is denied by the PSRO may request that the Secretary review the

decision of the PSRO. If the Secretary

determines that the PSRO has improperly denied the request. he shall

direct the PSRO to provide the requested information and it shail do so.

Notz-l%e Heaith Care Flnancins Administrtlon h= determined that this dew

menl does not contain a malor proposal re.

quirlng vreparatlon of”an Economm Impact

Statement under Executw Order 11S21 x

amended by Executive Order 11949. and

OMB Circular A-107.

Dated: Xovember 4.1977.

ROXCRT A. DERZOCS.

Administrator. Heafth Care

FhancingAdminMt ration.

Approved January 3.1978.

Jos.zPn A. CALIFANO, Jr..

Secretary.

[FR Dec. 7S-661 Fllsd 1-13-7S. 845 am]

47
APPENDIX Ill

NCHS GUIDELINES TO PREVENT DISCLOSURES

OF IDENTIFIABLE DATA 2

10. Avoiding Inadvertent Disclosures in Published Data

10.1 Problem. In their zeal to make available to the public a full set of

information on a given subject, statisticians may—and sometimes do—

present so much detail in published tabulations that they accidentally

reveal confidential information about particular study subjects. This may

happen in several ways. For example,

. .

A.

B.

c.

D.

E.

A single case” falls in cell ~iyi of a statistical table. If one knows

the individual in the population with characteristic ~i> the table

has disclosed that that individual also has characteristic yi.

Two cases fall in cell ~iyi of a statistical table. An individual in

the population with characteristics ~iyi can now know that the

other individual in the population with characteristic xi also has

the characteristic yi.

All cases in line yi of a statistical table fall in the cell in column

xi. We then know that any individual in the population with

characteristic y; also has characteristic xi.

Cell ~iyi gives the total income of all individuals with characteristics xi and yi. If there are only two individuals, a and b, in the

population with that combination of characteristics, then a,

knowing his own income, will be able to determine b’s income by

simple subtraction , and b will also be able to determine a’s income.

A table gives the total annual receipts for all five nursing homes

in county m. However, nursing home a is much larger than all the

rest combined; it accounts, in fact, for three-fourths of all nursing home receipts in the county. Knowing the county total, the

manager of nursing home a is able to calculate the incomes of the

other four homes, at least within some fairly narrow limits.

A Standard Metropolitan Statistical Area (SMSA) contains two

counties, a and b. Four hospitals are located in county a. and only

one in county b. A statistical report is published, giving confidential hospital data totaled for each SMSA. Another report is

published with confidential data on hospitals by county, but

only for counties with three or more hospitals. Using the two

reports one can subtract the data for county a from the SMSA

data, deriving the confidential data for the lone hospital in

county b.

2Excerpted from: National Center for Health Statistics: Sta& Manual on Con~ideiztiality, NCHS. DHEW Pub. No ~

(PHS) 78-1244. Public Health Service, DHEW, Hyattsville, Md., July 1978.

48
G. The maximum Social Security benefit for an individual retired

person is, say, $235 per month, A published table shows that

white males aged 70 to 74 in county a receive an average benefit

of $235 per month. It is now known that every white male aged

70 to 74 in county a who receives a Social Security payment

receives $235 a month.

These examples imply the existence of several general types of situations in which statistical disclosure may occur. An additional possibility

may be found in a group of three or more tables of subsets of a given

population from which disclosures are possible through the solution of

simultaneous equations. Center guidelines as set forth in Section 10.3

take into account the several possible disclosure situations.

10.2 Types of Disclosure. Center policy recognizes and attempts to deal

with several classes of disclosure:

A.

B.

c.

Exact versus approximate disclosures. Exact disclosure is the disclosure of a specific characteristic, such as race, sex, or a particular pathological condition, Approximate disclosure is the disclosure that a subject has a characteristic that falls within a

certain range of possibilities, such as being between 45 and 55

years of age or having an income between $15,000 and $25,000.

An approximate disclosure may in a given situation be considered

harmless because of its indefinite nature.

Probability-based versus certainty disclosures. Data in a table

,may indicate that members of a given population segment have

an 80-percent chance of having a certain characteristic; this

would be a probability-based disclosure as opposed to a certainty

disclosure of information on given individuals. In a sense, every

published table containing data or estimates of descriptors of a

specific population group provides probability-based disclosures

on members of that group, and only in unusual circumstances

could any such disclosure be considered unacceptable. It is possible that a situation could arise in which data intended for publication would reveal that a highly specific group had an extremely

high probability of having a given sensitive characteristic; in such

a case the probability-based disclosure perhaps should not be

published.

Internal versus external disclosures. Internal disclosures are those

that result completely from data published from one particular

study. External disclosures occur when outside information is

brought to bear upon the study data to create disclosures. This

possibility must be recognized in any disclosure analysis.

10.3 Special Guidelines for Avoiding Disclosure. Except where otherwise

indicated, the following guidelines apply to all Center publications of

statistics:

A. In no table should all cases of any line or column be found in a

single cell.

B. In no case should a single cell of a cross-tabulation contain only

one or two cases.

49
C. In no case should a quantity figure be based upon fewer than

three cases.

D. In no case should a quantity figure be published if one case

contributes more than 60 percent of the amount.

E. In no case should data on an identifiable case, nor any of the

kinds of data listed in preceding items A-D, be derivable through

subtraction or other calculation from the combination of tables

published on a given study.

F. Data pubhshed by NCHS should never permit disclosure when

used in combination with other known data.

Report writers and editors in the Center are to follow these guidelines. If a guideline appears unreasonable in a given situation, approval

for a special exception to the guideline should be requested from the

Director or the Deputy Director. The following types of cases represent

exceptions to the above guidelines which do not require special approval

from the Director or Deputy Director:

A. It has been a longstanding tradition in the field of vital statistics

not to suppress small frequency cells in the tabulation and presentation of data. For example, it has been considered important

to know that there were two deaths from rabies in Rio Arriba

County, N. Mex., in a given year, or that there were only one

infant death and two fetal deaths in Ait kin County, Minn. These

types of exceptions to generaJ NCHS practices in other programs

are followed because they have been accepted traditionally and

because they rarely, if ever, reveal any information about individuals that is not known socially.

B. Tables may show simple counts of number of persons, even

though the number in a cell is only “1” or “2,” provided the

classifying data are not judged to be sensitive in the context of

the table. For example, publication of counts of health manpower personnel by occupation by area are considered acceptable, if not accompanied by other distinguishing characteristics,

or other cross-classifications that have the effect of adding descriptive information about the same persons, Howeyer, publication of counts of personnel for a specified occupation by area by

income is not acceptable for cells of less than three persons because that would reveal sensitive income data.

10.4 Evaluating a Disdoywe Problem. There may be mitigating circumstances in a given situation which may make it acceptable to publish data

that, strictly speaking, could result in “disclosures.” Such circumstances

could provide grounds for requesting the “special exception” to the

previously noted rules:

A. When data in a study are based upon a small-fraction sample, for

example, less than 10 percent of the universe, it might generally

be assumed that disclosure will not occur through published tabulations. However; there could be exceptions. So much detail

may be presented that an individual unique in the population is

identified through the tables, or a member of the sample may

find himself and others in the data. The usual rules precluding
B.

c.

Do

publication of sampIe

small relative sampling

estimates that do not have a reasonably

error should prevent any disclosures from

occurring in tabulations from sample data.

The existence of errors or imputations in the data brings some

small reduction in the likelihood of disclosure through table publication,

Incompleteness of reporting, which often occurs even where

studies are supposed to include 100 percent of a given group in

the population, also reduces the certainty of any disclosure taking place through publication of data.

In some instances the danger of disclosure might by mitigated by

the fact that the data in {uestion have no se;sitiv;ty. T~ey ma~

already have appeared in a published directory, or they may

involve entirely obvious characteristics, or they may relate to an

earlier time. Since that time, many changes have occurred, so

that the data have become completely innocuous.

10.5 Measures To Avoid Disclosure. Two methods customarily used in

the Center to prevent disclosures from taking place through tabulations:

A. The table is reduced in size when rows or columns are combined

into larger categories, eliminating the particular cells that would

otherwise produce disclosures.

B. Unacceptable data in cells are suppressed. When this is done, it is

necessary also to suppress other cells in the table to prevent

determination of the unacceptable cell figure through subtraction. It is usually necessary to suppress four cells in a cross-tabulation in order to avoid disclosure through one cell–the offending cell (xi~i), another cell in the same row (x .yi)> another cell in

j

the same column as the offending cell (xi~j , and also the cell

(Xjyj) at the intersect of the additional row and column involved

in the newly suppressed cells.

11. Avoiding Inadvertent Disclosures Through Release of Microdata

Tapes

It is Center policy to make its files on individual elementary data

units available at cost to the scientific community so that additional

analyses can be made of these data for the country’s benefit. The scientific community has shown great interest in such tapes, and requests for

the Center’s tapes have increased rapidly in recent years. Except when

the file contains no confidential information, these “public use microdata tapes” are released without any identifiers, such as name or address,

or the reporting units.

11.1 Problem. Even though all personal identifiers are removed from

cases in a microdata file, a few items of information which appear as

variables on the tape may identify data subjects to any person who has

access to the information from another source. Thus, for example, if

tape descriptors indicate that the data subject is an attorney who grad51
uated from the University of Maryland but show nothing else about his

personal characteristics, the subject is not identified. If the tape goes on

to indicate that the attorney graduated in 1964, has a wife who graduated from Radcliffe in 1966, has three children, and lives in Fairfax

County, Vs., the subject is now probably identified uniquely, and all

information in the file about the subject would be disclosed to anyone

with access to the file who could then identify the person from the given

set of characteristics. The place of residence, especially when it is not a

heavily populated area, is particularly useful in the identification process.

The low-ratio sample that the Center uses in its surveys would usually frustrate a person who is trying to locate a known individual in the

Center’s survey. files. Thus, if a survey involves a 1:1,000 sample, the

investigator would have only one chance in a thousand of finding in the

file a particular individual whose data he is searching. However,, if the

investigator goes on a “fishing expedition” to find “anyone” in a file

who might be identified, chances are much better.

11.2 Mitigating Circumstances. The only absolutely sure way to avoid

disclosure through microdata tapes is to refrain completely from releasing any microdata tapes, but this would deprive the Nation of a great

deal of very important health research. Therefore the Center must make

a determination as. to when the public’s need is sufficiently great to

justify the risk of disclosure. It is the Center’s policy to release microdata

tapes for” purposes of statistical research only when the risk of disclosure

is judged to be extremely low. Some factors bearing upon the acceptability of this risk are the followimz:

.

A.

B.

As noted, when a su;ey involves only a proportionately very

small sample of establishments or individuals, there is small

chance that it will identify a given case of interest. (This assumes,

of course, that an investigator would not have a means of determining what cases fell into the sample.) Identification of an individual case would require a great deal of outside information not

likely to be found outside the survey itself. However, if the sam- “

ple is stratified and cases in certain strata are selected with high

probability, there is little or no advantage in reducing risk of

disclosure through sampling as far as cases in those strata are

concerned.

IdentifvinE .“individuals in the microdata file would usuallv be an .

expensive undertaking, hardly’ justified by the kind of information in the file. Public-use microdata files, in fact, should not

contain any information that would likely harm or embarrass the

individual or establishment if it should happen to be disclosed.

11.3 The Rules. The following rules apply to all microdata tapes released

by NCHS which contain any information about individual persons or

establishments, except where the supplier of information was told, prior

to his giving the information, that the information would be made public:

A. The tape must not contain any detailed information about the

subject that could facilitate identification and that is not essential for research pu~oses (e.g., exact date of the subject’s birth).

52
B.

c.

D.

.

E.

F.

Geographic places

to be identified on

that have fewer than 250,000 people are not

the tape.

Characteristics. of an aria are not to appear on the tape if they

would uniquely identify an area of less than 250,000 people.

Information on the drawing of the sample which might assist in

identifying a data subject must not be released outside the Center. Thus, the identities of primary sampling units are not to be

made available outside the Center.

Before any new or revised microdata tapes are published, they,

together with their full documentation, must be approved for

publication by the Director or Deputy Director.

A microdata ta~e .containing confidential data on unidentified

individuals or facilities may not be released to any person or

organization outside NCHS until that person, or a responsible

representative of that organization, has first signed the statement

on the Order Form, whereby he gives assurance that the data

provided will be used only for statistical reporting or research

purposes.

If it appears in any particular instance that the strict application of

one or more of these rules is inappropriate, a request should be submitted to the Director or Deputy Director to allow an exception.

Some organizations have the policy of introducing random errors

into their public-use microdata tapes in order to reduce the probability

of disclosure. This practice is undesirable from the standpoint that it

inevitably lessens the value of the tape for making sensitive statistical

analyses. Center staff are encouraged to study the feasibility and advisability of taking such steps in order to reduce further the risk of disclosures through use of the Center’s public-use tapes.

fd.1.S.GOVERNMENT PRINTING 0FFIcE:1980 311-240/8 1-3 53
VITAL AND HEALTH STATISTICS Series

Smics 1, Programs and Collection Procedures. —Reports which describe the general programs of the National

Center for Health Statistics and its offices and divisions and data collection methods used and include

definitions and other material necessary for understanding the data.

Series 2. Data Evaluation and Methods Research. –Studies of new statistical methodology including experimental tests of new survey methods, studies of vital statistics collection methods, new analytical

techniques, objective evaluations of reliability of collected data, and contributions to statistical theory.

Series 3. Analytical Studies. –Reports presenting analytical or interpretive studies based on vital and health

statistics, carrying the analysis further than the expository types of reports in the other series.

Styries 4. Documents and Committee Reports. –Final reports of major committees concerned with vital and

health statistics and documents such as recommended model vital registration laws and revised birth

and death certificates.

St%rim 10. Data From the Health Interview Survey. —Statistics on illness, accidental injuries, disability, use of

hospital, medical, dental, and other services, and other health-related topics, all based on data collected

in a continuing national household interview survey.

St,ri(,s 11. .!.)ata From the Health Examination Survey and the Healtn and Nutrition Examination Survey .–Data

from direct examination, testing, and measurement of national samples of the civilian noninstitutiotmlized population provide the basis for two types of reports: (1) estimates of the medically defined

prevalence of specific diseases in the United States and the distributions of the population with respect

to physical, physiological, and psychological characteristics and (2) analysis of relationships among the

various measurements without reference to an explicit finite universe of persons.

Stri~w 12. Data From the Institutionalized Pofmlation Surveys. –Discontinued effective 1975. Future reports from

these surveys will be in Series 13.

St’ri{.’s 13. Data on Health Resources Utilization. —Statistics on the utilization of health manpower and facilities

providing long-term care, ambulatory care, hospital care, and family planning services.

St’ric.v 14. Data on Health Resources: Manpower and Facilities. –Statistics on the numbers, geographic distribution, and characteristics of health resources including physicians, dentists, nurses, other health

occupations, hospitals, nursing homes, and outpatient facilities.

S~~itw20. Data on Afortality. —Various statistics on mortality other than as included in regular annual or monthly

reports. Special analyses by cause of death, age, and other demographic variables; geographic and time

series analyses; and statistics on characteristics of deaths not available from the vital records based on

sample surveys of those records.

Smiks 21. Data on Natality, Marriage, and Divorce. —Various statistics on natality, marriage, and divorce other

than as included in regular annual or monthly reports. Special analyses by demographic variables;

geographic and time series analyses; studies of fertility; and statistics on characteristics of births not

available from the vital records based on sample surveys of those records.

,st,rik~s2L2.~ata From the National Mortality and f\ratality Survey s. —Discontinued effective 1975. Future reports

from these sample surveys based on vital records will be included in Series 20 and 21, respectively.

Stqrit’s 23. Data From the National Survey of Family Growth. –Statistics on fertility, family formation and dissolution, family planning, and related maternal and infant health topics derived from a biennial survey

of a nationwide probability sample of ever-mmried women 15-44 years of age.

For ;1list of titles of reports published in these series, write to: Scientific and Technical Information Branch

National Center for Health Statistics

Public Health Service

Hyattsville, Md. 20782
NCHS US DEPARTMENT OF HEALTH. EDUCATION, AND WELFARE PoSTAGE AND FEES PAID

P“bl,c He,llh S,,.,,. u.S. DEPARTMENT OF HEW

Of f,ce of Health Research, S,mst,, x, and Techmioqy HEW 396

N,t,on,l Center for Health St, t,sr, c,

3700 E,n We,! H,qhw,y

Hvatls.’lle, Marvlam 20782 THIRD CLASS

OFFICIAL BUS IMESS

PENALTY FOR PRIVATE USE, $300

0*“US MAIL