Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals

1. Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals Gary N. Mears Project Director Information Ventures, Inc. Philadelphia, Pennsylvania

2. Authors: Gary Mears, Ed.D., Edward Burke, M.Ed., Mark Rothstein, J.D. Project funded by the Maternal and Child Health Bureau (MCHB) of the Health Resources and Services Administration (HRSA)

3. Independence Hall

4. Declaration of Independence

5. Liberty Bell

6. Philly Cream Cheese

7. The 1-3-6 Month UNHS Goals: • Universal detection of infant hearing loss before one month of age • Appropriate audiologic and medical evaluations regarding the presence of hearing loss before 3 months of age • The provision of intervention services by 6 months of age

8. 1-3-6 month goals endorsed by: • Joint Committee on Infant Hearing • American Academy of Pediatrics Task Force on Newborn and Infant Hearing • American Academy of Audiology • American Speech-Language-Hearing Association • NIH’s National Institute on Deafness and Other Communicative Disorders (NIDCD) • HRSA/MCHB

9. 1-3-6 Month Goals: Issues with Follow-up • Currently, funding has been provided for 52 states and territories for the purpose of implementing statewide early hearing detection and intervention programs. • Although data indicates that approximately 90 percent of infants are now screened by these programs for hearing loss before 1 month of age, about one-third of those who are referred from screening do not receive diagnostic evaluations by 3 months of age. • Furthermore, only about half of the infants and toddlers diagnosed with permanent hearing loss are enrolled in appropriate early intervention programs by 6 months of age.

10. Factors that may affect UNHS follow-up include: • Lack of adequate tracking information • Changes in the names or addresses of families • Absence of a designated medical home for the infant • Lack of audiologists equipped and trained to work with infants • Health insurance that refuses to cover follow-up services

11. Other factors affecting EHDI follow-up • Family moves, adoptions, and language and cultural barriers hamper access to early intervention programs. • Programs lacking data reporting requirements for tracking infants, staff to implement follow-up, and awareness among physicians of the urgency in diagnosing hearing loss. • JCIH Chair Judith Gravel: “Loss to follow-up is a major national issue, and the reasons may be different in every state and specific to local areas.”

12. 1-3-6 Month Goal Reporting: Information-Sharing Issues • Do data sharing problems exist between EHDI programs and entities they rely on to report screening, diagnostic, and early intervention service information? • Do these problems affect EHDI 1-3-6 month goal reporting? • Do HIPAA, FERPA, or State privacy laws affect EHDI 1-3-6 month goal reporting?

13. HIPAA, FERPA and State Privacy Laws: Issues The complexities of privacy regulations, including HIPAA and FERPA, and state privacy and public health reporting laws, may adversely affect the sharing of health information

14. HIPAA, FERPA and State Privacy Laws: Reporting Concerns • According to Mark Rothstein, Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics: “One of the issues that caused the subcommittee great concern was testimony that a misunderstanding of the HIPAA requirements, and concern about sanctions, were leading to defensive practices by those in possession of protected health information. Among these practices was a reported decline in public health reporting, both reporting mandated by state law and permissive under state law, but in either case permissible under HIPAA.”

15. HIPAA, FERPA and State Privacy Laws: Reporting Concerns continued • Laws protecting the privacy of individual health records were created due to advances in information technology and the increasing number of entities with access to health information. • Conflicts arise in the attempts to balance protecting patients’ privacy and permitting the flow of health information for necessary uses. • Could these laws affect reporting, or information sharing, between EHDI programs and entities providing services to infants and toddlers with hearing loss?

16. Project Activities: • Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information • Analysis of Federal and state laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up. • Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6-month service delivery goals.

17. Love Park

19. Activity One: • Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information.

20. Activity One: Background • HIPAA – Health Insurance Portability and Accountability Act • FERPA – Family Education Rights and Privacy Act

21. Activity One: Focus • Issues related to HIPAA, FERPA, and sharing of individual-level information (not aggregate) about infants and toddlers with hearing loss between state agencies in the referral and follow-up process, as reported within the most recent (i.e., 2006) state UNHS Program Applications, state UNHS Progress Reports to HRSA, and state Title V Narratives. • The activity focused most specifically on the relationship between EHDI and its Part C (Early Intervention) counterpart.

22. HIPAA • Became Federal law on August 21, 1996. • Title I of HIPAA concerns portability; the title describes health insurance coverage for workers and their families if they should change or lose their jobs. • Title II concerns accountability, and includes the Administrative Simplification provisions. Title II requires the Department of Health and Human Services (HHS) to establish national standards for electronic health care transactions and national identifiers for providers, health plans, and employers. The Administrative Simplification provisions in Title II were consolidated into three rules by HHS in developing HIPAA: the Privacy Rule, Transactions and Code Set Standard, and the Security Rule.

23. FERPA (Buckley Amendment) • Became law on August 21, 1974. • Protects the privacy of student education records, including records of children enrolled in Part C/early intervention programs under the Individuals with Disabilities Education Act (IDEA). • Provides parents with certain rights with respect to their children's education records; these rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Basic rights under FERPA include the right to inspect and review student education records maintained by schools, the right to request that schools correct records which are believed to be inaccurate or misleading, and the specific requirements under which education records can be released by schools.

24. EHDI/UNHS Chain Gang

25. Activity One: Results • EHDI and HIPAA • Twelve EHDI programs reported general concerns or issues in their state with HIPAA regarding data sharing. • Thirty-five EHDI Programs reported that they share data with the Part C programs in their state; 11 specifically mentioned data sharing is only done with parental consent. One state reported they do not share data with Part C, one reported no comprehensive data sharing about interventions, and one state reported they do not share individual-level data. Data-sharing information between EHDI and Part C programs was not provided in the reports for 17 states/territories.

26. Activity One: Results continued • EHDI and Part C: • Memoranda of Agreement or Understanding (MOA/MOU) were reported between four EHDI and Part C programs. One Interagency Agreement was reported between EHDI and Part C programs to “exchange data,” one Interagency Agreement was reported between EHDI and Part C programs for aggregate data only, and one reported “Interagency Data Linkages” between the two programs.

27. Activity One: Results continued • EHDI and Part C: • Data-sharing agreements or collaborations involving EHDI and Part C programs in five states are being “explored,” or “planned” in some way. • The relationship between 14 EHDI and Part C programs was described as “collaborative.”

28. Activity One: Results continued • EHDI, Part C and FERPA: • Nine EHDI programs reported specific concerns or issues with FERPA regarding data sharing with their Part C counterparts. • Two EHDI programs reported input from attorneys general within their states regarding HIPAA and/or FERPA issues.

31. Activity Two: • Analysis of Federal and State laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up

32. HIPAA’s Privacy Rule • Published by HHS on December 28, 2000, HIPAA’s Privacy Rule: • Provides the first comprehensive Federal protection for the privacy of health information. • Is carefully balanced to provide strong privacy protections that do not interfere with patient access to, or the quality of, health care delivery. • But requires careful legal interpretation in terms of whether or not it preempts provisions of State law.

33. HIPAA’s Privacy Rule • Can EDHI programs share information regarding children referred to them or information they are referring to other entities? Unless it conflicts with State law, Yes. • 45 C.F.R. § 164.512(b) of the Privacy Rule expressly permits disclosures without individual authorization to public health authorities authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to public health surveillance, investigation, and intervention.

34. HIPAA’s Privacy Rule and Protected Health Information (PHI) • PHI refers to any individually identifiable health information that is transmitted or maintained in any form or medium (e.g., electronic, paper, or oral), but excludes certain educational records and employment records. • For the purposes of disclosure, PHI generally limits releases of information to the minimum reasonably needed for the purpose of the disclosure.

35. FERPA – Family Education Rights andPrivacy Act • Protects the privacy of student education records, including the records of children enrolled in Part C/EI programs covered under the Individuals with Disabilities Education Act (IDEA). (Part C of IDEA —“Infants and Toddlers With Disabilities.”) • Law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

36. FERPA – Disclosure of Health-Related Information within Education Records • Under FERPA, records that are health-related are also considered to be part of a student’s education record and are, therefore, covered by the same privacy protections that may be included in a student’s record. • FERPA requires written parental consent before any record – including health records – are released outside of educational or legal boundaries. For example, FERPA’s Prior-Consent Rule does not permit schools to disclose records to State health agencies or to researchers without consent.

37. FERPA – Disclosure of Health-Related Information within Education Records continued • Public health entities have experienced particular difficulty in obtaining health-related information concerning children when such information is only available within school records. • Because FERPA protects the results and conclusions of diagnostic tests that are often conducted within school settings (e.g., autism and ADHD), such information is often lost to public health authorities.

38. FERPA – Disclosure of Health-Related Information within Education Records continued • Q: HIPAA vs. FERPA: Does HIPAA preempt FERPA? • A: No • The HHS Office for Civil Rights (OCR) concluded when developing HIPAA that "While we strongly believe every individual should have the same level of privacy protection for his/her individually identifiable health information, Congress did not provide us with authority to disturb the scheme it had devised for records maintained by educational institutions and agencies under FERPA. We do not believe Congress intended to amend or preempt FERPA when it enacted HIPAA.”

39. HIPAA & FERPA: Recommendations by NCVHS • The National Committee on Vital and Health Statistics (NCVHS) provided recommendations in 2004 to the Department of Health and Human Services, including: • That HHS should continue to work with the U.S. Department of Education to clarify how the Privacy Rule and FERPA interact with respect to confidentiality of school health records, and, where possible, to harmonize these regulations and issue guidance. • That HHS should make special efforts to focus its outreach and education activities, in a timely manner, on schools, physicians, and State health departments to clear up any confusion regarding the permissible disclosures of health information in the context of dealing with the health needs of students in a school setting.

40. HIPAA & FERPA: Joint HHS/DOE Report to Congress • Joint HHS/DOE Report to Congress Regarding Data Sharing • In 2004, HHS and DOE agreed to submit a joint report “within 18 months” to Congress that would describe the challenges to obtaining education records for public-health purposes in the absence of parental or patient consent and how these challenges could be overcome. In addition, the report would also include specific justifications for recommendations for changes, including changes to FERPA. • Report was due to be presented to Congress in June 2005. The report was not delivered at that time (and thus far has not been presented).

41. State Privacy Laws: Issues • State privacy codes/statutes are quite varied in terms of their scope and detail, reflecting the particular nature of the privacy needs and concerns of states at the time they were enacted. Many state privacy laws predate HIPAA and do not mention or refer to Federal law. • The terminology used, and their meanings, vary from State to State. In addition, specific codes/statutes often cross-reference to other codes/statutes in other areas of law, making it difficult to fully understand a particular code/statutes without reading all of the cross-referenced material.

42. State Privacy Laws: Issues continued • The health privacy codes/statutes in only five states contain specific language regarding compliance with HIPAA in some way (does not imply that other states are not in compliance with HIPAA). • The health privacy codes/statutes in two states contain language regarding sharing of individual-level information between child health agencies or programs. • The health privacy codes/statutes in 19 states contain language regarding disclosure of individual-level information with authorization.

43. State Privacy Laws: Issues continued • The health privacy codes/statutes in seven states contain language regarding disclosure of individual-level information without authorization. • The education privacy codes/statutes in 14 states contain language regarding compliance with FERPA in some way. (does not imply that other states are not in compliance with FERPA). • The education privacy codes/statutes in 12 states contain language regarding disclosure of individual-level information with consent.

44. Privacy-Related Newborn Hearing Screening State Codes/Statutes • Newborn hearing screening codes/statutes were identified in 42 states (inc. DC). • Newborn hearing screening codes/statutes of five states contain language regarding disclosure of individual-level information with parental authorization. • Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information by the department responsible for newborn hearing screening to the State Part C program.

45. Privacy-Related Newborn Hearing Screening State Codes/Statutes continued • Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information to the State Part C program with parental consent by the person who determines that a child has a hearing loss; in another State, the same procedure is required, but parental consent is not specified. • Newborn hearing screening codes/statutes of one State contains language regarding “linkage” to the State Part C program regarding referral options; parental consent is not specified.

46. Privacy-Related Newborn Hearing Screening State Codes/Statutes continued • Newborn hearing screening codes/statutes of one State contains language regarding a waiver of the requirement for authorization to disclose individual-level information. • Newborn hearing screening codes/statutes of 18 states contained language regarding newborn hearing screening tracking systems.

49. Activity Three: • Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6-month service delivery goals

50. Activity Three: Original plan: to analyze the possible facilitative effect that state birth defects registries (BDR) have on EHDI reporting of their 1-3-6-month service delivery goals. Use of BDR and EHDI data collected by CDC was considered for the analysis.