Missouri Code of State Regulations › Title 19 - DEPARTMENT OF HEALTH AND SENIOR SERVICES › Division 20 - Division of Community and Public Health › Chapter 20 - Communicable Diseases › Section 19 CSR 20-20.075 - Confidentiality of Information Obtained for Reporting of Communicable, Environmental and Occupational Diseases and Conditions

Current through Register Vol. 49, No. 14, July 15, 2024
PURPOSE: This rule requires local public health
				  agencies to establish confidentiality policies and procedures which are as
				  stringent as Missouri Department of Health (MDOH) policies and procedures for
				  information obtained for reporting of communicable, environmental and
				  occupational diseases. It also requires establishment of security policies and
				  procedures for access to MDOH information systems.
(1) Local public health agencies shall adopt
				and abide by confidentiality policies and procedures which are as stringent as
				Missouri Department of Health (MDOH) policies and procedures for information
				obtained for the reporting of communicable, environmental and occupational
				diseases defined in
				19
				CSR 20-20.020.
(2) Such information may be used only for
				investigation to determine the source of exposure and/or potential for spread;
				follow-up screening to monitor disease, exposure status, or communicability;
				counseling and patient education regarding the disease or condition and its
				prevention; administration of immunizations and/or prophylactic medications to
				the case or contacts; isolation and/or restriction of the client's or contact's
				activities; environmental assessment and other activities undertaken to
				eliminate the source of exposure; or epidemiologic analysis to determine trends
				in incidence, prevalence, treatment, disease progression, and/or risk factors
				associated with diseases.
(3) Local
				public health agencies shall forward reports to MDOH in accordance with
				19
				CSR 20-20.020. Otherwise, such information shall be
				released only in a statistical aggregate form that precludes and prevents the
				identification of an individual, physician, or medical facility except when
				such release is specifically authorized by law.
(4) Local public health agencies that access
				MDOH information systems shall establish security policies and procedures which
				are as stringent as MDOH policies and procedures to protect information systems
				against unauthorized data disclosure, modification, or destruction and to
				protect the integrity of the information system. Local public health agencies
				and employees who use MDOH information systems to perform their duties shall
				abide by MDOH policies and procedures for access to and use of information
				systems.
(5) Local public health
				agencies shall provide comprehensive training to employees on confidentiality
				and security policies, laws, and the administrative, civil, and criminal
				penalties for violations. Local public health agencies shall monitor employees
				to assure compliance with confidentiality laws, rules, policies and procedures.
				Local public health agencies shall immediately report to MDOH any breaches of
				confidentiality and security as specified by MDOH policy.
(6) Contractors performing work for MDOH or
				local public health agencies that involves access to information obtained for
				the reporting of communicable, environmental and occupational diseases shall be
				required, through their contracts, to abide by sections (1)-(5) of this
				rule.
*Original authority: 167.183, RSMo 1992; 191.656, RSMo
					 1988, amended 1992, 1993, 1996; 192.006, RSMo 1993, amended 1995; 192.020, RSMo
					 1939, amended 1945, 1951; 192.067, RSMo 1988; 192.802, RSMo 1992; and 701.328,
					 RSMo 1993, amended 1998.