Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals Gary N. Mears Project Director Information Ventures, Inc. Philadelphia,

Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals

Gary N. MearsProject Director

Information Ventures, Inc.Philadelphia, Pennsylvania

Authors: Gary Mears, Ed.D., Edward Burke, M.Ed., Mark Rothstein, J.D.

Project funded by the Maternal and Child Health Bureau (MCHB) of the

Health Resources and Services Administration (HRSA)

Monday, April 10, 20233

Independence Hall


Declaration of Independence


Liberty Bell


Philly Cream Cheese


The 1-3-6 Month UNHS Goals:

Universal detection of infant hearing loss before one month of age

Appropriate audiologic and medical evaluations regarding the presence of hearing loss before 3 months of age

The provision of intervention services by 6 months of age


1-3-6 month goals endorsed by:

Joint Committee on Infant Hearing American Academy of Pediatrics Task Force on

Newborn and Infant Hearing American Academy of Audiology American Speech-Language-Hearing Association NIH’s National Institute on Deafness and Other

Communicative Disorders (NIDCD) HRSA/MCHB


1-3-6 Month Goals: Issues with Follow-up

Currently, funding has been provided for 52 states and territories for the purpose of implementing statewide early hearing detection and intervention programs.

Although data indicates that approximately 90 percent of infants are now screened by these programs for hearing loss before 1 month of age, about one-third of those who are referred from screening do not receive diagnostic evaluations by 3 months of age.

Furthermore, only about half of the infants and toddlers

diagnosed with permanent hearing loss are enrolled in appropriate early intervention programs by 6 months of age.


Factors that may affect UNHS follow-up include:

Lack of adequate tracking information

Changes in the names or addresses of families

Absence of a designated medical home for the infant

Lack of audiologists equipped and trained to work with infants

Health insurance that refuses to cover follow-up services


Other factors affecting EHDI follow-up

Family moves, adoptions, and language and cultural barriers hamper access to early intervention programs.

Programs lacking data reporting requirements for tracking infants, staff to implement follow-up, and awareness among physicians of the urgency in diagnosing hearing loss.

JCIH Chair Judith Gravel: “Loss to follow-up is a major national issue, and the reasons may be different in every state and specific to local areas.”


1-3-6 Month Goal Reporting: Information-Sharing Issues

Do data sharing problems exist between EHDI programs and entities they rely on to report screening, diagnostic, and early intervention service information?

Do these problems affect EHDI 1-3-6 month goal reporting?

Do HIPAA, FERPA, or State privacy laws affect EHDI 1-3-6 month goal reporting?


HIPAA, FERPA and State Privacy Laws: Issues

The complexities of privacy regulations, including HIPAA and FERPA, and state privacy and public health reporting laws, may adversely affect the sharing of health information


HIPAA, FERPA and State Privacy Laws: Reporting Concerns

According to Mark Rothstein, Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics:

“One of the issues that caused the subcommittee great concern was testimony that a misunderstanding of the HIPAA requirements, and concern about sanctions, were leading to defensive practices by those in possession of protected health information. Among these practices was a reported decline in public health reporting, both reporting mandated by state law and permissive under state law, but in either case permissible under HIPAA.”


HIPAA, FERPA and State Privacy Laws: Reporting Concerns continued

Laws protecting the privacy of individual health records were created due to advances in information technology and the increasing number of entities with access to health information.

Conflicts arise in the attempts to balance protecting patients’ privacy and permitting the flow of health information for necessary uses.

Could these laws affect reporting, or information sharing,

between EHDI programs and entities providing services to infants and toddlers with hearing loss?


Project Activities:

1. Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information

2. Analysis of Federal and state laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up.

3. Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6-month service delivery goals.


Love Park



Activity One:

Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information.


Activity One: Background

HIPAA – Health Insurance Portability and Accountability Act

FERPA – Family Education Rights and Privacy Act


Activity One: Focus

Issues related to HIPAA, FERPA, and sharing of individual-level information (not aggregate) about infants and toddlers with hearing loss between state agencies in the referral and follow-up process, as reported within the most recent (i.e., 2006) state UNHS Program Applications, state UNHS Progress Reports to HRSA, and state Title V Narratives.

The activity focused most specifically on the relationship between EHDI and its Part C (Early Intervention) counterpart.


HIPAA

Became Federal law on August 21, 1996. Title I of HIPAA concerns portability; the title describes

health insurance coverage for workers and their families if they should change or lose their jobs.

Title II concerns accountability, and includes the Administrative Simplification provisions. Title II requires the Department of Health and Human Services (HHS) to establish national standards for electronic health care transactions and national identifiers for providers, health plans, and employers. The Administrative Simplification provisions in Title II were consolidated into three rules by HHS in developing HIPAA: the Privacy Rule, Transactions and Code Set Standard, and the Security Rule.


FERPA (Buckley Amendment)

Became law on August 21, 1974.

Protects the privacy of student education records, including records of children enrolled in Part C/early intervention programs under the Individuals with Disabilities Education Act (IDEA).

Provides parents with certain rights with respect to their

children's education records; these rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Basic rights under FERPA include the right to inspect and review student education records maintained by schools, the right to request that schools correct records which are believed to be inaccurate or misleading, and the specific requirements under which education records can be released by schools.


EHDI/UNHS Chain Gang


Activity One: Results

EHDI and HIPAA

Twelve EHDI programs reported general concerns or issues in their state with HIPAA regarding data sharing.

Thirty-five EHDI Programs reported that they share data with the Part C programs in their state; 11 specifically mentioned data sharing is only done with parental consent. One state reported they do not share data with Part C, one reported no comprehensive data sharing about interventions, and one state reported they do not share individual-level data. Data-sharing information between EHDI and Part C programs was not provided in the reports for 17 states/territories.


Activity One: Results continued

EHDI and Part C:

Memoranda of Agreement or Understanding (MOA/MOU) were reported between four EHDI and Part C programs. One Interagency Agreement was reported between EHDI and Part C programs to “exchange data,” one Interagency Agreement was reported between EHDI and Part C programs for aggregate data only, and one reported “Interagency Data Linkages” between the two programs.



EHDI and Part C:

Data-sharing agreements or collaborations involving EHDI and Part C programs in five states are being “explored,” or “planned” in some way.

The relationship between 14 EHDI and Part C programs was described as “collaborative.”



EHDI, Part C and FERPA:

Nine EHDI programs reported specific concerns or issues with FERPA regarding data sharing with their Part C counterparts.

Two EHDI programs reported input from attorneys general within their states regarding HIPAA and/or FERPA issues.




Activity Two:

Analysis of Federal and State laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up


HIPAA’s Privacy Rule

Published by HHS on December 28, 2000, HIPAA’s Privacy Rule:

Provides the first comprehensive Federal protection for the privacy of health information.

Is carefully balanced to provide strong privacy protections

that do not interfere with patient access to, or the quality of, health care delivery.

But requires careful legal interpretation in terms of whether or not it preempts provisions of State law.


HIPAA’s Privacy Rule

Can EDHI programs share information regarding children referred to them or information they are referring to other entities? Unless it conflicts with State law, Yes.

45 C.F.R. § 164.512(b) of the Privacy Rule expressly permits disclosures without individual authorization to public health authorities authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to public health surveillance, investigation, and intervention.


HIPAA’s Privacy Rule and Protected Health Information (PHI)

PHI refers to any individually identifiable health information that is transmitted or maintained in any form or medium (e.g., electronic, paper, or oral), but excludes certain educational records and employment records.

For the purposes of disclosure, PHI generally limits releases of information to the minimum reasonably needed for the purpose of the disclosure.


FERPA – Family Education Rights andPrivacy Act

Protects the privacy of student education records, including the records of children enrolled in Part C/EI programs covered under the Individuals with Disabilities Education Act (IDEA). (Part C of IDEA —“Infants and Toddlers With Disabilities.”)

Law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.


FERPA – Disclosure of Health-Related Information within Education Records

Under FERPA, records that are health-related are also considered to be part of a student’s education record and are, therefore, covered by the same privacy protections that may be included in a student’s record.

FERPA requires written parental consent before any record – including health records – are released outside of educational or legal boundaries. For example, FERPA’s Prior-Consent Rule does not permit schools to disclose records to State health agencies or to researchers without consent.


FERPA – Disclosure of Health-Related Information within Education Records continued

Public health entities have experienced particular difficulty in obtaining health-related information concerning children when such information is only available within school records.

Because FERPA protects the results and conclusions of diagnostic tests that are often conducted within school settings (e.g., autism and ADHD), such information is often lost to public health authorities.


FERPA – Disclosure of Health-Related Information within Education Records continued

Q: HIPAA vs. FERPA: Does HIPAA preempt FERPA?A: No

The HHS Office for Civil Rights (OCR) concluded when developing HIPAA that "While we strongly believe every individual should have the same level of privacy protection for his/her individually identifiable health information, Congress did not provide us with authority to disturb the scheme it had devised for records maintained by educational institutions and agencies under FERPA. We do not believe Congress intended to amend or preempt FERPA when it enacted HIPAA.”


HIPAA & FERPA: Recommendations by NCVHS

The National Committee on Vital and Health Statistics (NCVHS) provided recommendations in 2004 to the Department of Health and Human Services, including:

That HHS should continue to work with the U.S. Department of Education to clarify how the Privacy Rule and FERPA interact with respect to confidentiality of school health records, and, where possible, to harmonize these regulations and issue guidance.

That HHS should make special efforts to focus its outreach and education activities, in a timely manner, on schools, physicians, and State health departments to clear up any confusion regarding the permissible disclosures of health information in the context of dealing with the health needs of students in a school setting.


HIPAA & FERPA: Joint HHS/DOE Report to Congress

Joint HHS/DOE Report to Congress Regarding Data Sharing

In 2004, HHS and DOE agreed to submit a joint report “within 18 months” to Congress that would describe the challenges to obtaining education records for public-health purposes in the absence of parental or patient consent and how these challenges could be overcome. In addition, the report would also include specific justifications for recommendations for changes, including changes to FERPA.

Report was due to be presented to Congress in June 2005. The report was not delivered at that time (and thus far has not been presented).


State Privacy Laws: Issues

State privacy codes/statutes are quite varied in terms of their scope and detail, reflecting the particular nature of the privacy needs and concerns of states at the time they were enacted. Many state privacy laws predate HIPAA and do not mention or refer to Federal law.

The terminology used, and their meanings, vary from State to State. In addition, specific codes/statutes often cross-reference to other codes/statutes in other areas of law, making it difficult to fully understand a particular code/statutes without reading all of the cross-referenced material.


State Privacy Laws: Issues continued

The health privacy codes/statutes in only five states contain specific language regarding compliance with HIPAA in some way (does not imply that other states are not in compliance with HIPAA).

The health privacy codes/statutes in two states contain language regarding sharing of individual-level information between child health agencies or programs.

The health privacy codes/statutes in 19 states contain language regarding disclosure of individual-level information with authorization.


State Privacy Laws: Issues continued

The health privacy codes/statutes in seven states contain language regarding disclosure of individual-level information without authorization.

The education privacy codes/statutes in 14 states contain language regarding compliance with FERPA in some way. (does not imply that other states are not in compliance with FERPA).

The education privacy codes/statutes in 12 states contain language regarding disclosure of individual-level information with consent.


Privacy-Related Newborn Hearing Screening State Codes/Statutes

Newborn hearing screening codes/statutes were identified in 42 states (inc. DC).

Newborn hearing screening codes/statutes of five states contain language regarding disclosure of individual-level information with parental authorization.

Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information by the department responsible for newborn hearing screening to the State Part C program.


Privacy-Related Newborn Hearing Screening State Codes/Statutes continued

Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information to the State Part C program with parental consent by the person who determines that a child has a hearing loss; in another State, the same procedure is required, but parental consent is not specified.

Newborn hearing screening codes/statutes of one State contains language regarding “linkage” to the State Part C program regarding referral options; parental consent is not specified.


Privacy-Related Newborn Hearing Screening State Codes/Statutes continued

Newborn hearing screening codes/statutes of one State contains language regarding a waiver of the requirement for authorization to disclose individual-level information.

Newborn hearing screening codes/statutes of 18 states contained language regarding newborn hearing screening tracking systems.




Activity Three:

Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6-month service delivery goals


Activity Three:

Original plan: to analyze the possible facilitative effect that state birth defects registries (BDR) have on EHDI reporting of their 1-3-6-month service delivery goals. Use of BDR and EHDI data collected by CDC was considered for the analysis.


Activity Three: Data Concerns

After consultation with CDC, plan to do a quantitative analysis of BDR and EHDI data collected by CDC was scrapped. Reasons:

State BDR programs and their registries vary considerably in terms of BDR legislation, the kind of data they collect, and the methods used to collect data.

Epidemiological research on birth defects nationally via BDR data has been constrained by this variation in data and data collection methodology from state to state.

Most state BDRs do not even provide surveillance for hearing loss.

Consequently, analyzing CDC data regarding hearing loss as we had planned would certainly lead to questions about data integrity, and it would be difficult to develop valid conclusions.


Activity Three: Revised plan

Revised plan to conduct in-depth interviews with State EHDI staff regarding effect that state BDRs have on EHDI reporting of their 1-3-6-month service delivery goals.

Based on CDC and HRSA recommendations, staff of EHDI

programs in five states are selected to be interviewed.

States vary in terms of geographic size, location, and population demographics.

Interviews completed in early March 2007.


Activity Three: Results

BDR Facilitative Effect – Probably Variable

DR programs have a variable effect on UNHS program 1-3-6-month reporting from state to state.

These variations probably reflect the variations and idiosyncrasies that exist within and between the UNHS and BDR programs within each state.


Activity Three: Results continued

Observed Differences in Five States Surveyed

BDR programs either have a positive or facilitative effect,

OR

BDR programs have little or no effect with respect to UNHS reporting.


Activity Three: Results continued

There were variations reported in terms of state UNHS and BDR law, histories and funding of each program, and in program personnel.

Assumption: If more information regarding state UNHS programs were to be gathered, variations and differences such as these would continue to be found in the effects that BDR programs may have on 1-3-6-month reporting.




SummaryPrivacy Laws and EHDI: Issues

How do Federal and State privacy laws (i.e., HIPAA, FERPA, and State laws) affect the ability of EHDI to share information/data sharing in your state? To what extent are these laws affecting EHDI 1-3-6 month goal attainment and the reporting of these goals?

Is the EHDI program in your state a covered entity subject to the confidentiality protections of HIPAA?

Is the EHDI program in your state subject to the confidentiality provisions under Part C (which includes not only the part B regulations but also the protections of FERPA)?


Privacy Laws and EHDI: Recommendations

What can the EHDI program do to both respect the confidentiality provisions in FERPA (and Part C of IDEA) while trying to create a flow of information that can better serve children and families?

Obtain parental consent at the first point of contact. When the lead Part C agency is obtaining consent for an evaluation, they can at that point explain to the family that they would like to be able to communicate back with the specific primary referral source (i.e., EHDI); they would need to identify the program as well as identify the type of records that would be disclosed.

Consider developing an interagency agreement (between EHDI and Part C) that clarifies the purpose and scope of disclosures and the relevant requirements that apply to each of the programs (because of the many exceptions under HIPAA, FERPA and State law).


Privacy Laws and EHDI: Recommendations continued

What a FERPA-specific consent form needs to specify:

What EHDI will disclose to the Part C lead agency (e.g., the results of the hearing screening). The Part C/EI service referral form should be very specific to the Part C program.

What the Part C lead agency will disclose (e.g., evaluation results) and whether the child is determined eligible under Part C.

If the consent says the EHDI program will obtain information from the lead agency after referral to Part C, it also needs to specify that information cannot be redisclosed under FERPA.


Privacy Laws and EHDI: Recommendations continued

Each State has specific needs and statutes. Therefore, contact the attorney general's office in your state or your agency's general counsel regarding State codes/statutes.

Legal questions related to Part C of IDEA can be directed

to the Office of Special Education Programs; if related to FERPA, questions can be directed to the compliance office within the U.S. Department of Education.

Legal questions related to HIPAA can be directed to the Office of Civil Rights and HHS.



Contact Information:

Gary Mears, Ed.D.

Information Ventures, Inc.

42 S. 15th Street, Suite 700

Philadelphia, PA 19102

(215) 569-2300

[email protected]

Documents

Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals Gary N. Mears Project Director Information Ventures, Inc. Philadelphia,