HIPAA Privacy Rule Questions & Answers for NHAMCS
Q1. Am I required to comply with the HIPAA Privacy Rule?
A1. Health care providers who transmit certain financial and administrative health information electronically have been required to comply with the Rule since April 14, 2003. For example, if you submit claims electronically, you would be required to comply with the Rule.
Q2. Does the Privacy Rule allow me to participate in this survey?
A2. Yes. The Privacy Rule permits you to make disclosures of protected health information without patient authorization for public health purposes and for research that has been approved by an NCHS Ethics Review Board (ERB). This survey meets both of these criteria. Click to see the ERB approval letter [PDF – 106 KB] for NHAMCS.
Q3. What is protected health information?
A3. Protected health information includes all medical records and other individually identifiable information used or disclosed by an entity subject to the Privacy Rule. This includes directly identifiable information such as patient names, social security numbers and other information such as race and age that could be used to identify an individual.
Q4. What do I have to do to participate and comply with the Privacy Rule?
A4. There are several things that would assure that you comply with the Rule when participating in the survey. First, the privacy notice that you provide to your patients must indicate that patient information may be disclosed for research or public health purposes. Many of the model notices that have been developed and made available by professional associations provide this language.
Secondly, we have materials available on our website to assist you in verifying what information you are able to provide that is still in compliance with the requirements of the Privacy Rule. This includes the authority under which NCHS is collecting this information and that the information being collected is the minimum necessary.
Finally, your hospital may need to keep track of disclosures made for this survey. Since NCHS is a public health authority conducting surveillance, respondents can keep documentation of who accessed the data and when the data was accessed. To assist with this, your hospital will be provided with a document [PDF – 720 KB] that contains the information you would need to keep track of any disclosures made as part of your participation in NHAMCS.
Q5. Is there any other information that I need to assess to assure that my disclosure is authorized under the Privacy Rule?
A5. No. The letter [PDF – 276 KB] that your hospital received requesting that your hospital participate in this survey is from the Director of the National Center for Health Statistics (NCHS), which is part of CDC. The Privacy Rule, which is stated in the letter, specifies that your hospital is allowed to disclose information requested for public health purposes to public health agencies such as CDC without patient authorization.
Q6. What demonstrates that you are a public health authority?
A6. The survey is sponsored by the CDC/National Center for Health Statistics. CDC is a public health authority whose mission is to protect the health of the public. The letter [PDF – 276 KB] that we sent asking your facility to participate was sent on official CDC/NCHS letterhead and described our authority to conduct this survey. That letter also made clear that the U.S. Census Bureau is acting as our data collection agent. Finally, the Census Bureau representative has an official identification badge.
Q7. Why do we have to account for these disclosures?
A7. Under the Privacy Rule, patients have a right to an accounting of disclosures that have been made of their identifiable information for various purposes, including disclosures for public health and research purposes. To assist with this, your hospital will be provided with a document [PDF – 720 KB] that contains the information you would need to track of any disclosures made as part of your participation in NHAMCS.
Q8. Do we need to worry about whether this is the minimum necessary information for the purposes of the project?
A8. No. The Privacy Rule specifies that in providing information to public agencies, such as CDC, you may rely on our representation that the request constitutes the minimum necessary information required. This issue is also considered as part of the NCHS Ethics Review Board (ERB) approval process, and the Privacy Rule specifies that you may rely on the documentation of ERB approval that the information requested is the minimum necessary for the research purpose.
Q9. Do we have to have an Institutional Review Board (IRB) review this research project?
A9. No. For research projects, only one IRB must review the project, and the NCHS Ethics Review Board (ERB) (which has the authority to review such projects under the Regulations for the Protection of Human Subjects) has done so. We have the ERB approval letter [PDF – 106 KB] that indicates that a waiver has been approved by an ERB for this survey, and contains the documentation that is required by the Privacy Rule. If you desire, your hospital’s IRB may review the project as well.
Q10. What if we want our Institutional Review Board (IRB) to review this project?
A10. Your IRB could verify that the ERB approval letter [PDF – 106 KB] we have provided adheres to the requirements of the Privacy Rule, and NHCS could send you a copy of the materials submitted to the ERB.
Q11. Is a business associate contract required for my hospital to disclose protected health information to NCHS for the survey?
A11. No. A business associate contract is needed only when a person or entity is conducting a function or activity to help a provider carry out its health care function. NCHS is not a business associate of the provider. A business associate agreement is not required.
Q12. Where can we find the requirements of the Privacy Rule?
A12. The entire text of the Privacy Rule can be found at the U.S Department of Health & Human Services website. The following parts of the rule were referred to above:
- Disclosures without patient authorization – 45 CFR 164.512
- Disclosures for public health activities – 45 CFR 164.512(b)
- Disclosures for research purposes – 45 CFR 164.512(i)
- Limited data set and data use agreement – 45 CFR 164.514(e)
- Verification requirements – 45 CFR 164.514(h)
- Privacy notice – 45 CFR 164.520
- Accounting of disclosures – 45 CFR 164.528
- Minimum necessary requirements – 45 CFR 164.502(b) and 45 CFR 164.514(d)