Source: https://www.socialinterest.org/maximizing-linkages-a-policymakers-guide-to-data-sharing/
Timestamp: 2019-04-20 09:22:50+00:00

Document:
The ability to effectively leverage linkages to establish Integrated Eligibility Systems (IES), however, requires that agencies be willing to embrace opportunities to engage in cross-enrollment. One particular barrier that has surfaced with policymakers is their expressed concerns that privacy laws inhibit their ability to share data across systems. In order to bring more clarity to these perceived cultural and legal limitations, SIS’ policy analysis has revealed underutilized pathways to support data-sharing across multiple programs to support IES, as well as explicit authority to undertake targeted outreach and educational services between programs. For instance, the findings uncovered opportunities to leverage confidential health information, which has long been considered off limits under most circumstances, to support the administration of other public benefit programs.
The findings uncovered opportunities to leverage confidential health information, which has long been considered off limits under most circumstances, to support the administration of other public benefit programs.
In particular, SIS set out to better understand the boundaries and opportunities for data-sharing under federal and California privacy laws for four key public benefit programs: Temporary Assistance for Needy Families (TANF); Medicaid; Supplemental Nutrition Assistance Program (SNAP); and Special Supplemental Nutrition for Women, Infants and Children Program (WIC). This paper provides a deep dive into the federal and state statutes, regulations, and policies governing privacy rights in general — and data-sharing specifically — for each of the four programs.
This paper will review statutory and regulatory language to determine how each respective program’s data can be shared to support other public benefit programs.
State TANF and child welfare services have already developed successful data-sharing agreements, as encouraged by federal guidance provided by the Administration for Children & Families in the U.S. Department of Health and Human Services.
In California, recipients of TANF data — which may include public or private entities — must guarantee that they will adhere to the same confidentiality requirements that are applied to the state TANF agency.
State TANF agencies have broad flexibility to share applicant and recipient information with other agencies to improve coordination of services. Federal laws explicitly require TANF agencies to allow for data-sharing to support federal or federally-assisted programs, such as Medicaid and child welfare services (among other programs).
Federal and state laws explicitly permit TANF agencies to share applicant and/or recipient information to support other health and human service programs with regard to eligibility determinations.
The Health Insurance Portability and Accountability Act (HIPAA) provides significant authority to use and disclose protected health information (PHI) while also providing appropriate protections for sensitive information. In particular, further analysis of privacy law reveals opportunities to leverage Medicaid data in order to provide services to program beneficiaries.
HIPAA authorizes the release of PHI without consent for the purposes of treatment, payment, and health care operations, which may include quality assessment and improvement activities, including case management and care coordination, among other uses.
HIPAA regulations authorize Medicaid agencies to share PHI without consent of the individual to support other government agencies administering public benefits, if required or authorized by statute or regulation.
HIPAA regulations do require that Medicaid agencies, to the best extent possible, minimize both the amount and the number of persons who have access to PHI.
Significant leeway is provided to state SNAP administrators who seek to use and disclose applicant and recipient data to support the administration of other public benefit programs. Specifically, opportunities exist to leverage data collected in SNAP to engage in outreach to low-income individuals who have applied or may be considering applying for other social service programs with similar eligibility requirements, such as TANF and Medicaid.
Similarly, federal and state laws allow administrators to leverage SNAP applicant and recipient information to support eligibility verification for programs like Medicaid.
Federal regulations require state agencies to provide adequate notice to SNAP applicants that their personal information may be shared with other government agencies for eligibility verification purposes. In California, state law also requires that sufficient safeguards are in place to protect confidential applicant or recipient information.
State and local WIC agencies are fairly limited in their ability to use or disclose confidential information without consent from the applicant or recipient. However, federal and state law does recognize the need for WIC applicants or recipients to receive streamlined access to other medical assistance programs, such as Medicaid.
State and local WIC agencies are required to provide applicants or recipients information on Medicaid, as well as direct referral to state Medicaid agencies for families that are deemed eligible or presumptively eligible for additional health care services. States have executed on a variety of approaches to referrals between these programs to support cross-enrollment.
Federal regulations permit the use and disclosure of confidential WIC data for “non-WIC purposes” upon approval by the state’s Chief State Health Officer, among other requirements.
The Oregon Health Authority implemented policies and procedures that acquire consent from applicants and recipients during the application and certification stage of enrollment to allow for data-sharing between WIC and Head Start services.
Our guide also highlights the efforts of several state agencies, such as the California Department of Health and Human Services (CHHS), to establish innovative Intra-Agency Data Exchange Agreements that support data-sharing across departments to facilitate IES, program evaluation, and encourage cross-enrollment, among other benefits.
This guide is the second in a series that SIS has issued to empower government entities, advocates, and other stakeholders when considering data-sharing initiatives. Through safe, secure, and responsible data-sharing initiatives, governments can take a major step towards developing a public benefit system that provides dignified, efficient services to all of those that are in need.
Social service programs operated by state and county governments store critical data about individuals and their experiences that could be leveraged to improve outcomes and increase efficiencies across programs. Due to perceived legal barriers and other confidentiality concerns, many program administrators have been wary to explore the development of safe and secure data-sharing agreements with sister agencies. In contrast, private sector entities such as Google and Amazon have harnessed the power of data to forecast and subsequently meet consumer demand, and support their ability to make informed decisions related to organizational efficiency and scalability.
The purpose of this guide is to examine federal and state privacy laws that apply to key public programs, which can then begin to move critical data out of existing silos and use it in responsible ways to improve the health and well-being of communities. The analysis focuses specifically on permissible data-sharing of individual-level data for the purpose of streamlining eligibility verification processes and/or connecting program recipients with other benefits and services they may qualify to receive (e.g., outreach and referral services).
For many years, states have engaged in varying degrees of data-sharing as a common-sense way to streamline eligibility and enrollment processes for both consumers and providers — thereby reducing barriers for low-income families and bolstering program efficiency. For instance, data-sharing has been used to support cross-enrollment for so-called “categorical eligible” households, like SSI recipients, across programs. Some state Medicaid agencies have been able to decrease duplicative processes and accelerate enrollment by determining Medicaid eligibility based on an applicant’s eligibility determination issued by another program (such as SNAP). Others have used data-sharing to leverage SNAP data to verify income for Medicaid applicants, without requiring applicants to provide documentation a second time.
Some government agencies have gone even further to realize the potential of robust integrated eligibility & enrollment and data systems within the public sector. In Allegheny County, Pennsylvania, for example, the Department of Human Services embraced innovation to establish data-sharing across agencies to create a data warehouse to improve services to clients, inform policymaking, and evaluate program and operational effectiveness. A handful of other states (Colorado, Maryland, New York, North Carolina, South Carolina, as well as Pennsylvania) leverage Medicaid enrollment data to connect low-income seniors to SNAP in partnership with a third-party agency, based on research showing that increased food security improves health and reduces costs for this vulnerable population.
Still, much more work can be done to replicate these promising initiatives in other states and local municipalities. To help bring this vision into clearer view, SIS’ analysis seeks to provide insight into both perceived and real data-sharing barriers and capabilities within public benefit programs, so that more government agencies can build on these data-sharing success stories.
SIS’ analysis should not be interpreted to overlook data security as a foundational component of any data-sharing initiative. The capacity to protect the sensitive data of our most vulnerable citizens is tantamount to the ability to improve benefits access and efficiency across public benefit programs. The goal of this guide is to support and inform the development of responsible, secure data-sharing initiatives that may be used to improve outcomes for low-income families and individuals throughout the United States.
The Health Insurance Portability and Accountability Act (HIPAA), signed in 1996, is a foundational privacy law governing PHI. HIPAA helps define the key differences and overlap between PHI and personally identifiable information (PII). PHI includes any information received during the provision of health care that can be used to personally identify an individual, such as a medical record, laboratory report, or hospital bill. PII, by comparison, is defined as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.” Overlap between PHI and PII can occur when common identifiers, such as name, address, birth date, or Social Security number are associated with health information.
When PHI is requested, used, or disclosed by a covered entity or business associate, reasonable efforts must be taken to meet the minimum necessary standard, which means that data owners must limit information shared to what is relevant and necessary to achieve the intended purpose.
A covered entity must enter into a data use agreement (DUA) before there is any use or disclosure of a limited data set (e.g., PHI that excludes certain identifiers) to an outside institution or party for research, public health, or health care operation purposes without obtaining consent.
Covered entities must appoint a Privacy Official to oversee the organization’s data-privacy program.
The Privacy Rule does not prohibit a covered entity from using and disclosing PHI within certain limits and protections. Indeed, HIPAA specifically authorizes the release of PHI without consent, for the purposes of treatment, payment, and health care operations, which may include quality-improvement activities.
Covered entities and business associates ensure compliance by their workforce.
There are several other federal laws that address data-sharing for health and human services programs. The Privacy Act of 1974 (Privacy Act) governs the collection and dissemination of information about individuals by federal agencies. It includes stringent confidentiality provisions, but permits disclosure without the subject’s consent for a “routine use,” defined as “the use of such record for a purpose which is compatible with the purpose for which it was collected.” For instance, some public benefit program rules authorize — and, in some cases, require — state agencies to use data collected from their respective programs to support the administration of other federally-assisted programs (e.g., SNAP and TANF).
Confidentiality of Medical Information Act (CMIA) – The CMIA establishes additional confidentiality protections related to PHI. The Act protects the confidentiality of individually identifiable medical information obtained by a health care provider, health care service plan, or contractor, among others. Like HIPAA, CMIA permits the disclosure of PHI without patient authorization for the purposes of treatment, payment, and health care operations. However, CMIA differs from HIPAA in a few distinct ways: CMIA expands the definition of provider of health care to include any business that offers hardware or software — including mobile apps — that is expected to maintain medical information. Second, it provides individuals a private right of action when a violation of privacy has occurred, which HIPAA does not.
Information Practices Act – The Information Practices Act (IPA) expands limitations on the right of governmental agencies to disclose personal information about an individual. The statute generally defines “personal information” as any information that is maintained by an agency in California that can be used to identify or describe an individual (e.g., name, Social Security number, home address, etc.).
Recent examples from California suggest that the kind of data-sharing explored in this guide complies with the IPA. In 2014, for instance, the California Department of Health Care Services (DHCS) addressed the transfer of personal data from CalFresh (California’s SNAP program) to Medi-Cal (California’s Medicaid program) in order to streamline enrollment into expanded Medicaid. Because the use of SNAP enrollment information was compatible with the purpose for which it was collected (enrollment into a public benefit program), “Express Lane Eligibility” (as the program is known) was deemed permissible by federal and state authorities.
Chapter 5300 of the State Administrative Manual – Prepared by the Department of General Services through the Office of Information Security, the State Administrative Manual (SAM) outlines state administrative rules on the use and disclosure of personal information for all state entities unless otherwise explicitly exempted by law or state policy. In general, SAM provides statewide privacy guidelines and limitations on information that is owned or managed by state entities to restrict the use or disclosure of personal information for purposes outside of the original intent of its collection.
With regard to data-sharing, SAM permits “information asset owners, custodians, and users” to disclose, use, or make available personal information for purposes other than those for which it was originally collected if the use or disclosure is explicitly allowed under the IPA, among other criteria. SAM refers to information used by third parties to clarify that information asset owners and users shall apply the requirements of this policy to any third party handling personal information collected by the state entity, “in order to accomplish a state entity function that is consistent with the original purposes for which it was collected.” It also states that any third party and its staff with access to personal information must agree to be subject to the state entity’s privacy policies and practices.
CHHS’ Memorandum of Understanding and Intra-Agency Data Exchange Agreement –In 2016, CHHS issued a Memorandum of Understanding (MOU) and Intra-Agency Data Exchange Agreement to facilitate the integration and exchange of information between all CHHS departments, including California’s Department of Health Care Services (DHCS), Department of Public Health (CDPH), and Department of Social Services (CDSS). The MOU articulates that it is in compliance with all applicable federal, state, and local laws, regulations, and policies regarding data use and disclosure confidentiality, and thereby serves as the primary agreement to facilitate data exchange among CHHS departments. It seeks to bolster and streamline data integration within CHHS Departments by alleviating the need for “point-to-point” agreements except where mandated by the federal government or law. The Agreement further specifies that the MOU portion of the document is not intended to apply to CHHS departments that do not meet the definition of a covered entity or business associate under HIPAA, and therefore does not impose HIPAA requirements or standards on non-covered entities or components, such as WIC under CPDH, of CHHS departments.
In addition, the Agreement establishes a common set of terms and conditions to facilitate “secure interoperable data exchange between [and] among CHHS departments.” Other notable provisions include authorization of CHHS departments to provide, access, and/or use data collected by other departments for permitted purposes and only to the extent necessary, which permits data-sharing activities that comply with all applicable laws, rules and regulations.
CHHS’ Data Playbook, which provides guidance on the Agreement, clarifies that it is split into two parts: one Master Agreement, with boilerplate legal language; and subordinate “Business Use Case Proposals.” The Data Playbook also explains that business-use case proposals — which includes information such as data type, intended use, etc. — are used to document each data exchange under the Master Agreement. CHHS’s Agreement permits data providers to object to business-use case proposals from recipient Departments, which triggers a review of the specific proposal, unless the “transfer or receipt of data is required by law[.]” Finally, the Agreement states clearly that it “shall remain in full force and effect immediately from the date of execution [May 2016]…,” which indicates that the terms of the Agreement are still in effect.
Under TANF, the federal government provides grants to states that then have broad flexibility to carry out a wide range of income assistance services under TANF’s block grant structure. TANF is a time-limited income assistance program that supports families with children when the parents or other responsible relatives cannot provide for the family’s basic needs.
In 2015, the Administration for Children and Families (ACF) — the division of HHS that governs both TANF and the child welfare system — released guidance on data-sharing capabilities within TANF statute to support state efforts to establish data-sharing agreements to improve the economic and social well-being of foster youth. More specifically, ACF released an Information Memorandum to state TANF agencies, encouraging them to “coordinate, collaborate, and share data on the children, youth, and families that they serve,” particularly those in the foster care system.
ACF makes clear in the Information Memorandum that TANF allows for data-sharing to support state or tribal child welfare agencies, acknowledging that there are no statutory or regulatory barriers to doing so.
TANF has jurisdiction over data-sharing in the context of foster care maintenance. TANF federal regulations go a step further to articulate that a State Plan for financial assistance must provide that the use or disclosure of information concerning applicants and recipients be allowed, with certain safeguards, for purposes directly connected with, but not limited to, any of the following programs: TANF, Child Welfare Services, Child Support, Foster Care Maintenance, Medicaid, Social Services, Supplementary Security Income (SSI), among other Federal or federally assisted programs which provide assistance, in cash or in kind, or services, directly to individuals on the basis of need.
Subsection (b) of the statute authorizes any county welfare department in California to release its lists of applicants for, and/or recipients of, public social services to any other county welfare department overseen by CDSS. The statute also requires that applicant or recipient data be shared when requested by any county welfare department or CDSS.
Subsection (d) explicitly permits county welfare departments and CDSS to share data with other public agencies for eligibility verification or for purposes directly connected with the administration of public social services. The provision also allows for information exchange with county superintendents of schools or superintendents of school districts to facilitate the administration of federally assisted programs such as free or reduced-price school meals programs.
The statute also explicitly authorizes county welfare departments to provide, without client consent, information to a housing authority to aid in determining eligibility for housing programs or services for which the client has applied or which he or she is receiving, as long as the receiving agency complies with all state and federal confidentiality and privacy laws., The same provision states that the section may be implemented either through an automated data exchange system or through a manual system.
Such efforts on behalf of the state legislature appear to have been pursued in response to recommendations submitted on behalf of advocates that sought clarification on how to interpret state confidentiality law related to CalWORKS and CalFresh programs.
As described above, federal and state law provides state TANF agencies with significant opportunities to engage in data-sharing to improve access and outcomes for program applicants or recipients that may be eligible for other health and human services.
Fortunately, CDSS has a history of sharing data to support the administration of other social services programs, such as Medi-Cal and child welfare.
CDSS, DHCS use Data-Sharing to Support Foster Youth In 2015, CDSS and DHCS entered into an agreement with other relevant stakeholders that supported the use and disclosure of confidential data regarding youth in foster care. The agreement cites the statutory authority for both agencies to manage the administration and delivery of public social services. The agreement permits both agencies to identify and share with each other confidential information including medical data, mental health data, and demographic data to support the provision of services to children or non-minor dependents receiving child welfare services, among other stated goals. Under the MOU, CDSS agreed to comply with HIPAA when accessing or using confidential data provided by DHCS, and conversely, DHCS agreed to comply with CDSS confidentiality and security requirements, among other applicable federal and state privacy and security laws. The agreement now serves as a model agreement for state agencies that wish to pursue pathways provided through federal and state laws to leverage CalWORKS data in a way that is mutually beneficial for providers and consumers of public social services in California.
SNAP is administered at the federal level by the Food and Nutrition Service (FNS) at the U.S. Department of Agriculture (USDA). SNAP is a federally funded, state-operated anti-hunger program that provides nutritional assistance to low-income individuals and families. The Federal government supports the full cost of SNAP benefits, while states share the cost of administering the program. In 2017, the SNAP program helped 42 million people nationwide afford a nutritionally balanced diet, including roughly ten percent of the population in California.
Federal SNAP laws permit data-sharing. In fact, the statute includes a section that directs the USDA to develop data exchange standards to govern, among other things, “necessary categories of information that state agencies operating related programs are required under to law to electronically exchange with another state agency.” In 2017, USDA issued a Request for Information to support FNS’ ability to designate data exchange standards, which identifies data-sharing and analysis as a way to improve SNAP services. In particular, SNAP statute requires the state agency to establish safeguards that permit the disclosure of applicant household information to persons directly connected with administration of other “federal assistance programs,” including “federally assisted state programs.”  The federal statute also authorizes state SNAP agencies to inform low-income households about the availability, eligibility requirements, application procedures and the benefits of SNAP.
Federal regulations set in place certain requirements for data-sharing within SNAP. For example, regulations require that state SNAP agencies execute a data-exchange agreement with the other state agency before exchanging information. The recipients of SNAP information are also required to adequately protect against unauthorized disclosure of information. Federal SNAP regulations give states’ the option to use or disclose SNAP applicant or recipient information to support the administration of other federally assisted state programs that serve low income individuals. Further, the federal rules permit data-sharing to streamline eligibility determinations for individuals that may become categorically eligible for SNAP because they qualify for other public assistance programs, such as SSI or TANF., In addition, the rule explicitly permits state SNAP agencies to exchange information with other state agencies that administer programs such as TANF, Medicaid, and SSI for purposes of maintaining and using an income and eligibility verification system (IEVS).
CalFresh and CalWORKS confidentiality requirements are governed by the same state statute. As noted above, California law permits confidential applicant or recipient information to be shared, with proper safeguards, for purposes directly connected with the administration of public social services.
In particular, SNAP statute requires the state agency to establish safeguards that permit the disclosure of applicant household information to persons directly connected with administration of other “federal assistance programs,” including “federally assisted state programs.” The federal statute also authorizes state SNAP agencies to inform low-income households about the availability, eligibility requirements, application procedures and the benefits of SNAP.
The places where CalWORKS and CalFresh privacy rules diverge are described in CDSS’ Manual of Policies and Procedures (MPP), which provides a regulatory framework for the confidentiality of public assistance information in accordance with state confidentiality and privacy laws, as well as federal regulations.
Similar to federal SNAP regulations, CalFresh rules described in the MPP allow for the use or disclosure of applicant or recipient household information. The data may be used to support the administration of other federal, or federally assisted state programs that provide assistance to low-income individuals. The use or disclosure of CalFresh data can also be shared with other public agencies at the federal or state level to support administration of various assistance programs, as well as for audit and law enforcement purposes. State rules also permit the exchange of CalFresh data to supervisors of school districts to support federally assisted programs such as the free or reduced-price school meal program. As with other programs, state regulation requires agencies that receive CalFresh applicant or recipient data to take appropriate measures to protect against its unauthorized disclosure.
Similar to TANF, federal laws and regulations create pathways to support the use and disclosure of SNAP data to enhance coordination across public assistance programs. Federal SNAP law provides state agencies with the authority to inform low-income households of their potential eligibility for SNAP benefits, along with other helpful resources that may streamline access to the program. The statute provides local agencies the ability to engage in outreach to low-income individuals who have applied, or may be considering applying for, other social service programs with similar eligibility requirements, such as TANF and Medicaid. As noted above, the statute explicitly permits the exchange of applicant household information to support the administration of other public assistance programs. Many states already utilize SNAP data to support the administration of social service programs like Medicaid, which often relies on SNAP data during the eligibility and renewal process for beneficiaries.
As demonstrated by California’s execution of the aforementioned Express Lane Eligibility strategy, there is no limitation on the ability of state or county welfare departments to share confidential CalFresh data with DHCS. Indeed, subsection (f) lays the groundwork by empowering CDSS to create rules that allow for local county welfare departments to provide or exchange information with agencies, public or private, that are engaged in planning, providing, or securing social services for or on behalf of recipients or applicants. State regulations require recipients of CalFresh data to take “appropriate measures” to protect against unauthorized disclosure of CalFresh applicant or recipient data. However, federal regulations do require that state agencies provide adequate notice to SNAP applicants that PII may be shared with other government agencies for eligibility verification services. States typically fulfill this requirement by providing notice on SNAP application and recertification forms.
Medicaid was established in 1965 under the Social Security Act and is jointly financed by state and federal governments to assist low-income families and individuals in accessing health coverage. Medicaid privacy laws are different from other public benefit programs in that most information is considered PHI rather than just PII.
Many states already utilize SNAP data to support the administration of social service programs like Medicaid, which often relies on SNAP data during the eligibility and renewal process for beneficiaries.
Conducting or assisting an investigation, prosecution, or civil or criminal proceeding related to the administration of the plan.
In addition, the federal Medicaid statute requires that state agencies enter into interagency agreements to support eligibility determinations for Medicaid under the State Plan. The statute specifically refers to interagency agreements with public agencies that include, but are not limited to, TANF, WIC, SNAP, and Child Care Development Block Grants.
Recognizing that Medicaid beneficiaries may also face various other public health challenges, federal agencies have in the past partnered to coordinate federal efforts to support state-level data-sharing and information systems to improve outcomes for vulnerable populations.  In fact, in 1998, the Health Care Financing Administration (subsequently named the Centers for Medicare & Medicaid Services [CMS] in 2001), the Health Resources and Services Administration (HRSA) and the Centers for Disease Control and Prevention (CDC) signed an interagency agreement to allow states to link data sets that would develop activities to support improvements in Medicaid and public health program design and outcomes. Such efforts have paved the way for data-sharing between state public health departments and Medicaid programs to improve health outcomes of people living with HIV, among other critical public health initiatives.
Referrals for the same eligible individuals, or presumptively eligible individuals, to the local agency responsible for administering the WIC program.
Medicaid agencies are also required to provide information on the WIC program throughout the year to all Medicaid beneficiaries who may meet the requirements of the program, including those found to be presumptively eligible.
Medicaid information may also be shared to support other public benefit programs. For example, HIPAA’s Privacy Rule authorizes covered entities to share client PHI related to eligibility or enrollment in Medicaid to support another government agency administering a public benefit, if required or authorized by statute or regulation. Additionally, the HIPAA Privacy Rule authorizes covered entities to disclose PHI to another government agency providing public benefits if the programs serve the same or similar populations and the disclosure is deemed necessary to coordinate the covered functions of such program or to improve administration and management related such functions.
California statute mirrors the federal Medicaid rules to require that any use or disclosure of confidential information about Medi-Cal applicants or recipients be related to the administration of the program. Permissible program operations include, but are not limited to: establishing eligibility; determining the amount of medical assistance; providing services for recipients; law enforcement purposes; and auditing of the program. The statute also makes clear that all Medi-Cal data that may be used to identify an applicant or recipient must be adequately safeguarded.
State statute allows Medicaid agencies to develop data-sharing initiatives that disclose PHI. In particular, subsection (f) of the statute provides DHCS the authority to establish rules that authorize data-sharing with agencies, public or private, that are engaged in planning, providing, or securing such services for applicants or recipients.
A California Medi-Cal regulation limits the disclosure of all individual medical records without the written consent of the beneficiary or their personal representative. However, the regulation clarifies that it does not preclude the release of information between individuals or institutions providing care, fiscal intermediaries, and state or local official agencies. This is consistent with the authority provided under federal and state Medicaid privacy laws that allow for the disclosure of PHI to other government agencies to support the administration of other public benefit programs.
Massachusetts Supports Sharing Medicaid Data to Support WIC Outreach Services In 2006, the Massachusetts Department of Public Health’s WIC program entered into a data-sharing agreement with Massachusetts’s Office of Medicaid (MassHealth) to enhance enrollment, coordination, and collaboration across programs. In particular, the agreement provides for “targeted outreach to families who are receiving MassHealth benefits and who are eligible for WIC benefits in order to increase utilization of program services.” The agencies cite authority to establish such an agreement pursuant to both WIC and Medicaid federal law, which requires coordinated operations between the two programs.
In addition, the agreement addresses HIPAA concerns by referring to regulation that allows covered entities to share information with other public benefits agencies if authorized by state law or regulation. Finally, there is reference to the state laws that provide authority under the HIPAA regulatory pathway. The agreement allows for the state Medicaid agency to share contact information — including but not limited to full name, date of birth, and address — with the Massachusetts WIC program in order to identify MassHealth members who are eligible but not yet enrolled by authorizing WIC Management Information System staff to conduct a data match for individuals identified as WIC-eligible but not enrolled in WIC. In addition, the agreement authorizes WIC staff access to Medicaid/MassHealth’s coverage portal to determine specific MassHealth coverage types and therefore presumptive eligibility for the WIC program. Once they are identified, the state WIC agency sends a postcard to the MassHealth member with information highlighting specifics on what WIC offers and mentions that “most MassHealth members who are pregnant or have children under age 5 are eligible for WIC benefits and services.” The individual is encouraged to contact a WIC office in their community, call the WIC 1-800 number, or visit the website for more information.
For streamlining eligibility determinations, federal regulations specify that purposes directly related to the administration of the State Plan may include establishing eligibility and providing services for recipients. Such activities allow for data-sharing specifically within the context of providing services for recipients, such as when a Medi-Cal beneficiary is determined to be at nutritional risk by their health care provider and referred to WIC or CalFresh to receive nutritional assistance. Medi-Cal regulations provide further support for this interpretation by explicitly authorizing health agencies to exchange information between individuals or institutions providing care, and state or local office agencies. However, Medicaid regulations do require state agencies to create interagency agreements in order to do so. California has made great progress toward this goal by developing the Intra-Agency Data Exchange Agreement in 2016 (described in Part II), and more can be done.
To implement a process that allows for joint access to critical Medicaid and public health data without duplication of effort by developing policies and protocols related to sharing relevant data; data systems planning and development; data analysis; needs assessments; and quality assurance reviews, as permitted by state and federal law; […] and to promote long-range planning as it relate to data-sharing.
Similar to SNAP, the WIC program is administered at the federal level by the USDA’s Food and Nutrition Service (FNS). WIC’s services are provided through federal grants to states for supplemental foods, health care referrals, and nutrition education to support nearly 7.2 million low-income women, infants, and children up to age five who are found to be at nutritional risk each year.
The WIC federal statute remains mostly silent on the use and disclosure of applicant and recipient information. The statute requires state WIC agencies to provide certain nutrition-education services and/or materials to individuals applying or reapplying for the program. In doing so, state WIC agencies must provide individuals with written information about the Medicaid program, as well as a referral to agencies that can determine presumptive eligibility for Medicaid, if individuals are not participating in the program and appear to meet the family income requirements.
Federal WIC regulations are much more prescriptive than the statue, specifying that WIC data is confidential, regardless of the original source and exclusive of previously applicable confidentiality laws. FNS issued rules in 2000 and 2006 to remove barriers to coordination among programs caused by these regulatory restrictions on sharing confidential WIC recipient information. The rules clarify that WIC confidentiality protections, rather than HIPAA requirements or any other federal, state or local programs’ confidentiality provisions, attach to and take precedence in protecting WIC applicant and recipient information. Put simply, under most circumstances, WIC-related data is considered exempt from HIPAA and, similarly, WIC service providers are not generally considered covered entities under HIPAA.
Federal WIC regulations mandate that state agencies limit the use and disclosure of WIC data to persons directly connected with the administration or enforcement of the WIC program who the state agency determines have a “need to know” for WIC program purposes. The rule also clarifies that “persons” may include, but are not limited to: personnel from its local agencies (LAs) and other WIC state or local agencies; persons under contract with the state WIC agency to perform research regarding the WIC program; and various law enforcement professionals. For example, the regulations permit release forms authorizing disclosure to private physicians or other health care providers to be included as part of the WIC application or certification process, but clarify that all other requests for applicants or recipients to sign voluntary release forms must occur after the application and certification process is completed. With some exceptions, participant’s consent must be obtained in order to disclose WIC-related data to any third party, or other programs and health providers.
However, WIC regulations do explicitly address integration with other health and human services. In particular, federal rules require state WIC agencies to combine WIC program intake procedures with intake procedures for other health programs or services administered by state and local agencies, whenever possible. Such “merging” activities may include verification procedures, certification interviews, and income computations. In addition, regulation explicitly requires WIC agencies to provide applicants and recipients’ information on – and referral to – other health-related and public assistance programs, when appropriate.
However, WIC regulations do explicitly address integration with other health and human services. In particular, federal rules require state WIC agencies to combine WIC program intake procedures with intake procedures for other health programs or services administered by state and local agencies, whenever possible. Such “merging” activities may include verification procedures, certification interviews, and income computations. In addition, regulation explicitly requires WIC agencies to provide applicants and recipients’ information on — and referral to — other health-related and public assistance programs, when appropriate.
Assessing and evaluating the responsiveness of the state’s health system to a recipients’ health care needs and outcomes.
Any agreement between the state and local WIC agency and a public organization must also include assurances that the organization will not use the information for any other purpose or share it with a third party.
Requested by another local WIC agency to verify that individual’s program eligibility and to investigate potential dual participation.
Further, section IV of the WIC Policies and Procedures Manual (WPPM) states that when a local agency is part of a multi-service social service and/or health agency that provides more than WIC services, such as a hospital or a county health department, non-WIC personnel may have access to PII — but only if written consent is first obtained from the applicant or recipient.
Finally, section VII outlines reporting requirements for local agency employees to adhere to when handling confidential information. Any suspected breach of the security of such confidential information must be reported the day that the loss or suspected breach of confidential information is discovered — a higher standard than under HIPAA.
State regulation sets in place referral requirements as well. For example, local WIC agencies are required to provide WIC applicants and recipients with information on Medi-Cal and other health-related or public assistance programs at each certification. Local agencies must also determine, during certification, if any additional programs would benefit the applicant or recipient, and provide the necessary information for accessing the service(s) — such as a description of the program’s benefits, or the specific steps required to access the program — as well as attempt to provide targeted referrals to program.
In comparison to other public benefit programs, federal WIC laws and regulations place relatively strict limitations on the use and disclosure of confidential data without consent from the applicant or recipient. Despite these limitations, pathways exist to foster data-sharing agreements between WIC and other health and human service programs that serve similar populations.
For instance, federal WIC statute requires state and local WIC agencies to provide individuals applying or reapplying for the program information on Medicaid, as well as referral to agencies that determine eligibility for Medicaid services. In doing so, the provision implicitly acknowledges that WIC applicants, recipients, and their families will benefit from expanded access to comprehensive health care services as provided through Medicaid. By requiring coordination between the two programs, federal law recognizes the value of information exchange as a useful and necessary tool to ensure eligible, and presumptively eligible, WIC families receive every opportunity to access quality health services through Medicaid. Similarly, federal and state regulation support opportunities to educate and provide referral to other public assistance programs for WIC applicants and recipients.
Provide in the State Plan a list of organizations with which the state has executed or intends to execute a written agreement. The written agreement must also meet certain requirements as defined in regulations.
Given the complex challenges faced by WIC recipients to meet their families’ health care needs, it would benefit state and local WIC agencies to explore the opportunities laid out in federal statutes and regulations to establish processes that connect WIC applicants or recipients to other health and human services. To meet WIC consent requirements, state or local WIC agencies may want to consider automatic opt-in procedures to lay the groundwork for future coordination with other programs that serve persons eligible for WIC. Such efforts could be used to improve outcomes for WIC recipients by streamlining access to critical supports and services including child care, health, food assistance, and workforce development, as well as other resources that may prove useful in empowering program recipients.
Given the complex challenges faced by WIC recipients to meet their families’ health care needs, it would benefit state and local WIC agencies to explore the opportunities laid out in federal statutes and regulations to establish processes that connect WIC applicants or recipients to other health and human services., To meet WIC consent requirements, state or local WIC agencies may want to consider automatic opt-in procedures to lay the groundwork for future coordination with other programs that serve persons eligible for WIC. Such efforts could be used to improve outcomes for WIC recipients by streamlining access to critical supports and services including child care, health, food assistance, and workforce development, as well as other resources that may prove useful in empowering program recipients.
While the WIC pathway toward data-sharing requires coordination at the state and local level, federal WIC regulators recognize that opportunities should exist to establish robust data-sharing agreements for non-WIC purposes, allowing local agencies to more effectively meet the needs of their clients. For instance, efforts to build on the referral requirements laid out in federal and state regulation could be used to streamline application processes within other programs that would benefit the WIC applicant or recipient.
Oregon WIC Uses Data-Sharing to Coordinate Services With Head Start Program In Oregon, the agency that governs WIC services — Oregon Health Authority (OHA) — entered into a data-sharing agreement with the Oregon Head Start Association (OHSA), a nonprofit that provides services related to the Head Start preschool education program. Founded on the grounds that both programs serve a similar population, the agreement allows for greater coordination of care between WIC and OHSA staff to ensure clients receive streamlined certification, nutrition education, home visits, and parent training, among other resources. The foundation of OHA’s MOU clarifies that WIC recipients must have signed a release to share their personal information when they first enter the program.
Further, Oregon WIC’s data-sharing agreement with OHSA provides a blueprint for ways to seek consent at the application and certification stage of enrollment., Of note, OHA staff ensure that WIC recipients are notified that attending an approved OHSA nutrition education class during their current WIC certification period can be used to satisfy their nutrition education requirements for the program. Thus, WIC recipients are provided an incentive to sign a release of information, while also receiving other helpful information about the benefits of the OHSA program.
Oregon’s data-sharing partnership was successful because it effectively captured client consent. By contrast, Minnesota encountered issues executing an otherwise laudable data-sharing effort. In 2015, FNS conducted a Management Evaluation of Minnesota Department of Health’s WIC program and found that the agency was not in compliance with data privacy requirements. In particular, FNS found that Minnesota’s WIC program had shared recipient names and contact information with the state’s Child and Teen Check-up program, which is administered by the same agency, without first obtaining written consent from the WIC recipient, parent, or guardian. As stated above, federal regulations require that a recipient’s consent must be obtained in order to release WIC to any third party, even when sharing with other programs and health providers within the same agency.
Data-sharing capabilities are within reach for government entities. While appropriate measures must be taken to ensure the safe and secure exchange of information, the benefits of establishing robust integrated data systems are significant. SIS has compiled a list of general practices for government entities and other relevant stakeholders to consider when exploring opportunities to leverage social service data for good.
Clearly Define the Purpose: As discussed throughout this guide, the ability to adequately frame the problem and/or purpose for desired data-sharing activities is integral toward developing effective and secure data-sharing agreements. Such efforts should also identify the key data elements necessary to complete the project.
Conduct a Survey of the Landscape: Cataloging data-sharing initiatives within a state can inform future endeavors by deepening stakeholder knowledge as to what agreements are currently in place and the data types that are already being shared. Such an exercise can reveal opportunities to build upon or replicate certain provisions within existing agreements.
Commit the Resources: Dedicate resources that match the complexity and reach of the proposed data-sharing agreement. Such resources may include staff time, technical assistance, adequate training in data management, investments in IT infrastructure and security, etc.
Build Consensus: Reach consensus among relevant stakeholders — such as government agencies, public and private entities, etc. — by engaging in open dialogue to discuss data-related challenges, programmatic goals, data accessibility and standardization, as well as best practices.
Maintain Cross-Agency Coordination: Formalize and facilitate regular communication between relevant staff by identifying “data-sharing liaisons” to support the effective exchange of information and subsequent analysis as defined within the data-sharing agreement.
Identify Leadership: Government agencies need data-sharing champions, with the power to commit adequate resources, to support strong agreements with sister agencies that are built around coordination, transparency, and accountability.
Establish Legal Parameters: Efforts should be made to include an entity’s legal counsel early on to ensure that the proposed agreement and its stated goals adequately address federal and state rules related to data privacy and protection, etc.
Standardize Processes: Develop and implement an agency-wide data governance model that supports a systematic approach toward tracking all external and internal data-sharing activities to establish cohesive authority, conflict resolution procedures, management, and decision-making processes.
Track Outcomes/Value: Consider short- and long-term benefits of data-sharing by developing metrics to measure outcomes of data-sharing activities to determine business value, cost savings, enrollment, etc.
Develop a Resource Hub: Many government agencies have cited limited resources (or expertise) as a key constraint to data-sharing. State administrators could collaborate to create a statewide, web-based “data-sharing hub” for the purpose of compiling and disseminating materials and/or resources to educate and assist relevant stakeholders in their ability to establish safe, secure, and cost-effective data-sharing agreements that support low-income individuals and families while adhering to confidentiality requirements.
In California, CHHS has developed a web-based “Data Playbook” that provides numerous materials to support intra-agency data-sharing efforts including toolkits, training resources, etc.
Create a Checklist: Ensuring adequate safeguards is a key component toward sharing sensitive client data. State administrators may consider producing checklists to serve as a guide for stakeholders on key data privacy and security requirements for outside entities, such as agency staff, state contractors, or other state agencies that seek to leverage PII and/or PHI within these respective programs. For instance, the checklist may clarify that proposed agreements must outline appropriate technical, physical, and administrative safeguards to protect PII/PHI, among other general requirements.
Expand Data-Matching Strategies: Some states have interpreted federal and state law to support data-matching across programs that serve similar populations (e.g. Medicaid and WIC) to engage in targeted outreach and referral processes.
In Massachusetts, state administrators have leveraged HIPAA pathways to authorize Medicaid agencies to use and disclose PHI to support data-matching with local WIC agencies to reach families that are WIC eligible but unenrolled.
Utilize Public Health Nexus: Identify opportunities to leverage consumer data across programs within the context of providing services to recipients— such as SNAP and WIC outreach and referral — for Medicaid recipients determined to be at nutritional risk by their health care provider.
Formalize Referral Processes: Federal and state laws support varied levels of coordination among social service agencies. In order to maximize referral processes, state administrators may consider issuing guidance that clearly defines what information may be shared within a program referral, or in what fashion a referral may be transferred, and to what end. Such information may help to facilitate state or local agency efforts to enroll eligible but unenrolled recipients in other programs more effectively through smart, secure, and robust referral processes.
Establish Consent: Develop educational materials and training for assisters to aid their ability to inform applicants or recipients of other programs for which they may be eligible. Such training should also support assisters’ ability to obtain consent from applicants or recipients during the application and recertification processes. In addition, administrators may explore opportunities to leverage automatic opt-in processes with proper notification provided to the applicant or recipient.
Despite the gradual shift to embrace information exchange among government agencies, more work can be done. When executed in a responsible and purposeful way, data-sharing has the ability to maximize efficiencies and address critical social determinants of health using limited resources to target eligible but unenrolled individuals to bolster cross-enrollment, or linkages, between social services programs. In addition, efforts to support thoughtful, secure data sharing across agencies can lay the groundwork for targeted outreach and education, and ensure low-income individuals and families are made aware of and can receive the full array of supports for which they qualify.
The ability for government to effectively provide person-centered, comprehensive services will require a shift at the federal, state, and local-levels to embrace concepts that harness the power of data. There are many lessons to be learned from federal and state agencies that have already engaged in data-sharing to improve outcomes for beneficiaries. Examples from across the country have shown the many shared benefits of harnessing data for good to support eligibility and enrollment procedures, cost efficiency, program evaluation, and informed decision-making. In order to fully realize the potential of data-sharing, state administrators will need to grapple with the legal and cultural issues associated with confidentiality and privacy protections which have often served as a major roadblock to information exchange. Once on solid footing, administrators can begin the process of removing the silos built around consumer data to create a government that is better equipped to meet the unique needs of individuals and families.
Khaliyl N. Lane is a Senior Policy Analyst on Social Interest Solutions’ Strategy and Innovation Team, where he combines both lived experience and in-depth policy expertise to improve beneficiaries’ experience within health and human service programs. In this role, Khaliyl provides policy analysis, research and technical assistance to develop human-centered solutions and thought leadership at the intersection between policy and technology. He is the primary author of SIS’s data-sharing guide, which addresses a variety of health and human services programs, including Medicaid, SNAP, Child Welfare, among other programs.
 45 C.F.R §160 and Subparts A and C of §164.
 The Breach Notification Rule, issued in 2013; requires covered entities to notify when there is a breach of unsecured PHI. The Breach Rule directs entities to notify affected individuals, the Secretary of Health and Human Services (HHS), and, under certain circumstances, the media within specified periods of time in the event of a health data breach.
 Privacy Act of 1974, 5 U.S.C. §552a.
 Most substance abuse treatment programs are also subject to the HIPAA Privacy Rule. In 2004, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued guidance that summarizes variance between the two Rules and implementation solutions. That guidance can be found at http://www.hipaa.samhsa.gov/download2/SAMHSAPart2-HIPAAComparison2004.pdf.
 California (CA) Civil Code § 56 et seq.
 Office of Family Assistance, Ibid.
 CA W&IC §10850 et. seq.
 CDSS and DHCS, pursuant to WIC, Division 9, § 10000 et seq., are responsible for the administration and delivery of public social services.
 CA W&IC §10051 defines “public social services” as those activities and functions of state and local government administered or supervised by the department or the State Department of Health Services and involved in providing aid or services or both, including health care services and medical assistance, to those people of the state who, because of their economic circumstances or social condition, are in need thereof and may benefit thereby.
 CA W&IC §10850 and the federal Privacy Act of 1974.
 CA W&IC §10850(f). The law also allows for the use and disclosure of non-identifiable data for research purposes.
 CA W&IC §11525. Also represents state law that supports research for TANF-specific purposes. Specifically, it requires CDSS establish procedures to provide access to information on CalWORKS families to counties and researchers to support ongoing monitoring, research, and evaluation of the program. However, the provision mandates that CDSS ensure that the information identifiable to individuals and families is removed to maintain strict confidentiality. Other research-related data disclosures include sharing CalWORKS information with a university center for the purposes of linking the data with other appropriate data to evaluate the impact of the program. The provision again stresses that CDSS must ensure that information identifiable to individuals and families is removed to maintain confidentiality.
 CDSS’ Manual of Policies and Procedures (MPP) §19-004.6 authorizes the disclosure of confidential information concerning CalWORKs families to support the administration of federally-assisted programs, such as free or reduced-price school meals.
 MPP §19-008. CalWORKS regulation specifies that the purpose of public assistance and social service records is to evidence eligibility and delivery of public social services. The applicant’s or recipient’s record should only contain facts relevant to his or her case.
 7 U.S.C. §2011 et seq.
 MPP §63-201.311 – 316 et seq.
 42 U.S.C. §1396 et seq.
 7 C.F.R 246 (d)(1)(i) – See 71 Federal Register 56707 for further background.
 Subsection (h)(3) also requires the State WIC agency or its local agencies include in its State Plan, a list of all public organizations or government agencies with which the WIC agency or its local agencies has executed or intends to execute a written agreement.

References: §160
 §164
 §552
 § 56
 §10850
 § 10000
 §10051
 §10850
 §10850
 §11525
 §19
 §19
 §2011
 §63
 §1396