1. Effects of Federal and State Privacy Laws on 1-3-6 Month Service Delivery Goals Gary N. Mears Project Director Information Ventures, Inc. Philadelphia, Pennsylvania

2. Authors: Gary Mears, Ed.D., Edward Burke, M.Ed., Mark Rothstein, J.D. Project funded by the Maternal and Child Health Bureau (MCHB) of the Health Resources and Services Administration (HRSA)

3. Tuesday, February 11, 20143 Independence Hall

4. Tuesday, February 11, 20144 Declaration of Independence

5. Tuesday, February 11, 20145 Liberty Bell

6. Tuesday, February 11, 20146 Philly Cream Cheese

7. Tuesday, February 11, 20147 The 1-3-6 Month UNHS Goals: Universal detection of infant hearing loss before one month of age Appropriate audiologic and medical evaluations regarding the presence of hearing loss before 3 months of age The provision of intervention services by 6 months of age

8. Tuesday, February 11, 20148 1-3-6 month goals endorsed by: Joint Committee on Infant Hearing American Academy of Pediatrics Task Force on Newborn and Infant Hearing American Academy of Audiology American Speech-Language-Hearing Association NIHs National Institute on Deafness and Other Communicative Disorders (NIDCD) HRSA/MCHB

9. Tuesday, February 11, 20149 1-3-6 Month Goals: Issues with Follow-up Currently, funding has been provided for 52 states and territories for the purpose of implementing statewide early hearing detection and intervention programs. Although data indicates that approximately 90 percent of infants are now screened by these programs for hearing loss before 1 month of age, about one-third of those who are referred from screening do not receive diagnostic evaluations by 3 months of age. Furthermore, only about half of the infants and toddlers diagnosed with permanent hearing loss are enrolled in appropriate early intervention programs by 6 months of age.

10. Tuesday, February 11, 201410 Factors that may affect UNHS follow-up include: Lack of adequate tracking information Changes in the names or addresses of families Absence of a designated medical home for the infant Lack of audiologists equipped and trained to work with infants Health insurance that refuses to cover follow-up services

11. Tuesday, February 11, 201411 Other factors affecting EHDI follow-up Family moves, adoptions, and language and cultural barriers hamper access to early intervention programs. Programs lacking data reporting requirements for tracking infants, staff to implement follow-up, and awareness among physicians of the urgency in diagnosing hearing loss. JCIH Chair Judith Gravel: Loss to follow-up is a major national issue, and the reasons may be different in every state and specific to local areas.

12. Tuesday, February 11, 201412 1-3-6 Month Goal Reporting: Information- Sharing Issues Do data sharing problems exist between EHDI programs and entities they rely on to report screening, diagnostic, and early intervention service information? Do these problems affect EHDI 1-3-6 month goal reporting? Do HIPAA, FERPA, or State privacy laws affect EHDI 1-3-6 month goal reporting?

13. Tuesday, February 11, 201413 HIPAA, FERPA and State Privacy Laws: Issues The complexities of privacy regulations, including HIPAA and FERPA, and state privacy and public health reporting laws, may adversely affect the sharing of health information

14. Tuesday, February 11, 201414 HIPAA, FERPA and State Privacy Laws: Reporting Concerns According to Mark Rothstein, Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics: One of the issues that caused the subcommittee great concern was testimony that a misunderstanding of the HIPAA requirements, and concern about sanctions, were leading to defensive practices by those in possession of protected health information. Among these practices was a reported decline in public health reporting, both reporting mandated by state law and permissive under state law, but in either case permissible under HIPAA.

15. Tuesday, February 11, 201415 HIPAA, FERPA and State Privacy Laws: Reporting Concerns continued Laws protecting the privacy of individual health records were created due to advances in information technology and the increasing number of entities with access to health information. Conflicts arise in the attempts to balance protecting patients privacy and permitting the flow of health information for necessary uses. Could these laws affect reporting, or information sharing, between EHDI programs and entities providing services to infants and toddlers with hearing loss?

16. Tuesday, February 11, 201416 Project Activities: 1.Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information 2.Analysis of Federal and state laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up. 3.Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6-month service delivery goals.

17. Tuesday, February 11, 201417 Love Park

18. Tuesday, February 11, 201418

19. Tuesday, February 11, 201419 Activity One: Identification of the approaches that state newborn hearing screening programs have taken regarding HIPAA, FERPA, and the sharing of health information.

20. Tuesday, February 11, 201420 Activity One: Background HIPAA – Health Insurance Portability and Accountability Act FERPA – Family Education Rights and Privacy Act

21. Tuesday, February 11, 201421 Activity One: Focus Issues related to HIPAA, FERPA, and sharing of individual-level information (not aggregate) about infants and toddlers with hearing loss between state agencies in the referral and follow-up process, as reported within the most recent (i.e., 2006) state UNHS Program Applications, state UNHS Progress Reports to HRSA, and state Title V Narratives. The activity focused most specifically on the relationship between EHDI and its Part C (Early Intervention) counterpart.

22. Tuesday, February 11, 201422 HIPAA Became Federal law on August 21, 1996. Title I of HIPAA concerns portability; the title describes health insurance coverage for workers and their families if they should change or lose their jobs. Title II concerns accountability, and includes the Administrative Simplification provisions. Title II requires the Department of Health and Human Services (HHS) to establish national standards for electronic health care transactions and national identifiers for providers, health plans, and employers. The Administrative Simplification provisions in Title II were consolidated into three rules by HHS in developing HIPAA: the Privacy Rule, Transactions and Code Set Standard, and the Security Rule.

23. Tuesday, February 11, 201423 FERPA (Buckley Amendment) Became law on August 21, 1974. Protects the privacy of student education records, including records of children enrolled in Part C/early intervention programs under the Individuals with Disabilities Education Act (IDEA). Provides parents with certain rights with respect to their children's education records; these rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Basic rights under FERPA include the right to inspect and review student education records maintained by schools, the right to request that schools correct records which are believed to be inaccurate or misleading, and the specific requirements under which education records can be released by schools.

24. Tuesday, February 11, 201424 EHDI/UNHS Chain Gang

25. Tuesday, February 11, 201425 Activity One: Results EHDI and HIPAA Twelve EHDI programs reported general concerns or issues in their state with HIPAA regarding data sharing. Thirty-five EHDI Programs reported that they share data with the Part C programs in their state; 11 specifically mentioned data sharing is only done with parental consent. One state reported they do not share data with Part C, one reported no comprehensive data sharing about interventions, and one state reported they do not share individual-level data. Data-sharing information between EHDI and Part C programs was not provided in the reports for 17 states/territories.

26. Tuesday, February 11, 201426 Activity One: Results continued EHDI and Part C: Memoranda of Agreement or Understanding (MOA/MOU) were reported between four EHDI and Part C programs. One Interagency Agreement was reported between EHDI and Part C programs to exchange data, one Interagency Agreement was reported between EHDI and Part C programs for aggregate data only, and one reported Interagency Data Linkages between the two programs.

27. Tuesday, February 11, 201427 Activity One: Results continued EHDI and Part C: Data-sharing agreements or collaborations involving EHDI and Part C programs in five states are being explored, or planned in some way. The relationship between 14 EHDI and Part C programs was described as collaborative.

28. Tuesday, February 11, 201428 Activity One: Results continued EHDI, Part C and FERPA: Nine EHDI programs reported specific concerns or issues with FERPA regarding data sharing with their Part C counterparts. Two EHDI programs reported input from attorneys general within their states regarding HIPAA and/or FERPA issues.

29. Tuesday, February 11, 201429

30. Tuesday, February 11, 201430

31. Tuesday, February 11, 201431 Activity Two: Analysis of Federal and State laws governing the sharing of individual health and education information with respect to newborn hearing screening and follow-up

32. Tuesday, February 11, 201432 HIPAAs Privacy Rule Published by HHS on December 28, 2000, HIPAAs Privacy Rule: Provides the first comprehensive Federal protection for the privacy of health information. Is carefully balanced to provide strong privacy protections that do not interfere with patient access to, or the quality of, health care delivery. But requires careful legal interpretation in terms of whether or not it preempts provisions of State law.

33. Tuesday, February 11, 201433 HIPAAs Privacy Rule Can EDHI programs share information regarding children referred to them or information they are referring to other entities? Unless it conflicts with State law, Yes. 45 C.F.R. § 164.512(b) of the Privacy Rule expressly permits disclosures without individual authorization to public health authorities authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to public health surveillance, investigation, and intervention.

34. Tuesday, February 11, 201434 HIPAAs Privacy Rule and Protected Health Information (PHI) PHI refers to any individually identifiable health information that is transmitted or maintained in any form or medium (e.g., electronic, paper, or oral), but excludes certain educational records and employment records. For the purposes of disclosure, PHI generally limits releases of information to the minimum reasonably needed for the purpose of the disclosure.

35. Tuesday, February 11, 201435 FERPA – Family Education Rights and Privacy Act Protects the privacy of student education records, including the records of children enrolled in Part C/EI programs covered under the Individuals with Disabilities Education Act (IDEA). (Part C of IDEA Infants and Toddlers With Disabilities.) Law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

36. Tuesday, February 11, 201436 FERPA – Disclosure of Health-Related Information within Education Records Under FERPA, records that are health-related are also considered to be part of a students education record and are, therefore, covered by the same privacy protections that may be included in a students record. FERPA requires written parental consent before any record – including health records – are released outside of educational or legal boundaries. For example, FERPAs Prior-Consent Rule does not permit schools to disclose records to State health agencies or to researchers without consent.

37. Tuesday, February 11, 201437 FERPA – Disclosure of Health-Related Information within Education Records continued Public health entities have experienced particular difficulty in obtaining health-related information concerning children when such information is only available within school records. Because FERPA protects the results and conclusions of diagnostic tests that are often conducted within school settings (e.g., autism and ADHD), such information is often lost to public health authorities.

38. Tuesday, February 11, 201438 FERPA – Disclosure of Health-Related Information within Education Records continued Q: HIPAA vs. FERPA: Does HIPAA preempt FERPA? A: No The HHS Office for Civil Rights (OCR) concluded when developing HIPAA that "While we strongly believe every individual should have the same level of privacy protection for his/her individually identifiable health information, Congress did not provide us with authority to disturb the scheme it had devised for records maintained by educational institutions and agencies under FERPA. We do not believe Congress intended to amend or preempt FERPA when it enacted HIPAA.

39. Tuesday, February 11, 201439 HIPAA & FERPA: Recommendations by NCVHS The National Committee on Vital and Health Statistics (NCVHS) provided recommendations in 2004 to the Department of Health and Human Services, including: That HHS should continue to work with the U.S. Department of Education to clarify how the Privacy Rule and FERPA interact with respect to confidentiality of school health records, and, where possible, to harmonize these regulations and issue guidance. That HHS should make special efforts to focus its outreach and education activities, in a timely manner, on schools, physicians, and State health departments to clear up any confusion regarding the permissible disclosures of health information in the context of dealing with the health needs of students in a school setting.

40. Tuesday, February 11, 201440 HIPAA & FERPA: Joint HHS/DOE Report to Congress Joint HHS/DOE Report to Congress Regarding Data Sharing In 2004, HHS and DOE agreed to submit a joint report within 18 months to Congress that would describe the challenges to obtaining education records for public-health purposes in the absence of parental or patient consent and how these challenges could be overcome. In addition, the report would also include specific justifications for recommendations for changes, including changes to FERPA. Report was due to be presented to Congress in June 2005. The report was not delivered at that time (and thus far has not been presented).

41. Tuesday, February 11, 201441 State Privacy Laws: Issues State privacy codes/statutes are quite varied in terms of their scope and detail, reflecting the particular nature of the privacy needs and concerns of states at the time they were enacted. Many state privacy laws predate HIPAA and do not mention or refer to Federal law. The terminology used, and their meanings, vary from State to State. In addition, specific codes/statutes often cross- reference to other codes/statutes in other areas of law, making it difficult to fully understand a particular code/statutes without reading all of the cross-referenced material.

42. Tuesday, February 11, 201442 State Privacy Laws: Issues continued The health privacy codes/statutes in only five states contain specific language regarding compliance with HIPAA in some way (does not imply that other states are not in compliance with HIPAA). The health privacy codes/statutes in two states contain language regarding sharing of individual-level information between child health agencies or programs. The health privacy codes/statutes in 19 states contain language regarding disclosure of individual-level information with authorization.

43. Tuesday, February 11, 201443 State Privacy Laws: Issues continued The health privacy codes/statutes in seven states contain language regarding disclosure of individual-level information without authorization. The education privacy codes/statutes in 14 states contain language regarding compliance with FERPA in some way. (does not imply that other states are not in compliance with FERPA). The education privacy codes/statutes in 12 states contain language regarding disclosure of individual-level information with consent.

44. Tuesday, February 11, 201444 Privacy-Related Newborn Hearing Screening State Codes/Statutes Newborn hearing screening codes/statutes were identified in 42 states (inc. DC). Newborn hearing screening codes/statutes of five states contain language regarding disclosure of individual-level information with parental authorization. Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information by the department responsible for newborn hearing screening to the State Part C program.

45. Tuesday, February 11, 201445 Privacy-Related Newborn Hearing Screening State Codes/Statutes continued Newborn hearing screening codes/statutes of one State contains language regarding disclosure of individual-level information to the State Part C program with parental consent by the person who determines that a child has a hearing loss; in another State, the same procedure is required, but parental consent is not specified. Newborn hearing screening codes/statutes of one State contains language regarding linkage to the State Part C program regarding referral options; parental consent is not specified.

46. Tuesday, February 11, 201446 Privacy-Related Newborn Hearing Screening State Codes/Statutes continued Newborn hearing screening codes/statutes of one State contains language regarding a waiver of the requirement for authorization to disclose individual-level information. Newborn hearing screening codes/statutes of 18 states contained language regarding newborn hearing screening tracking systems.

47. Tuesday, February 11, 201447

48. Tuesday, February 11, 201448

49. Tuesday, February 11, 201449 Activity Three: Analysis of state utilization of birth defects registries and whether such utilization improves capability in reporting hearing loss-related service provision and the attainment of the 1-3-6- month service delivery goals

50. Tuesday, February 11, 201450 Activity Three: Original plan: to analyze the possible facilitative effect that state birth defects registries (BDR) have on EHDI reporting of their 1-3-6-month service delivery goals. Use of BDR and EHDI data collected by CDC was considered for the analysis.

51. Tuesday, February 11, 201451 Activity Three: Data Concerns After consultation with CDC, plan to do a quantitative analysis of BDR and EHDI data collected by CDC was scrapped. Reasons: State BDR programs and their registries vary considerably in terms of BDR legislation, the kind of data they collect, and the methods used to collect data. Epidemiological research on birth defects nationally via BDR data has been constrained by this variation in data and data collection methodology from state to state. Most state BDRs do not even provide surveillance for hearing loss. Consequently, analyzing CDC data regarding hearing loss as we had planned would certainly lead to questions about data integrity, and it would be difficult to develop valid conclusions.

52. Tuesday, February 11, 201452 Activity Three: Revised plan Revised plan to conduct in-depth interviews with State EHDI staff regarding effect that state BDRs have on EHDI reporting of their 1-3-6-month service delivery goals. Based on CDC and HRSA recommendations, staff of EHDI programs in five states are selected to be interviewed. States vary in terms of geographic size, location, and population demographics. Interviews completed in early March 2007.

53. Tuesday, February 11, 201453 Activity Three: Results BDR Facilitative Effect – Probably Variable DR programs have a variable effect on UNHS program 1-3-6-month reporting from state to state. These variations probably reflect the variations and idiosyncrasies that exist within and between the UNHS and BDR programs within each state.

54. Tuesday, February 11, 201454 Activity Three: Results continued Observed Differences in Five States Surveyed BDR programs either have a positive or facilitative effect, OR BDR programs have little or no effect with respect to UNHS reporting.

55. Tuesday, February 11, 201455 Activity Three: Results continued There were variations reported in terms of state UNHS and BDR law, histories and funding of each program, and in program personnel. Assumption: If more information regarding state UNHS programs were to be gathered, variations and differences such as these would continue to be found in the effects that BDR programs may have on 1-3-6-month reporting.

56. Tuesday, February 11, 201456

57. Tuesday, February 11, 201457

58. Tuesday, February 11, 201458 Summary Privacy Laws and EHDI: Issues How do Federal and State privacy laws (i.e., HIPAA, FERPA, and State laws) affect the ability of EHDI to share information/data sharing in your state? To what extent are these laws affecting EHDI 1-3-6 month goal attainment and the reporting of these goals? Is the EHDI program in your state a covered entity subject to the confidentiality protections of HIPAA? Is the EHDI program in your state subject to the confidentiality provisions under Part C (which includes not only the part B regulations but also the protections of FERPA)?

59. Tuesday, February 11, 201459 Privacy Laws and EHDI: Recommendations What can the EHDI program do to both respect the confidentiality provisions in FERPA (and Part C of IDEA) while trying to create a flow of information that can better serve children and families? Obtain parental consent at the first point of contact. When the lead Part C agency is obtaining consent for an evaluation, they can at that point explain to the family that they would like to be able to communicate back with the specific primary referral source (i.e., EHDI); they would need to identify the program as well as identify the type of records that would be disclosed. Consider developing an interagency agreement (between EHDI and Part C) that clarifies the purpose and scope of disclosures and the relevant requirements that apply to each of the programs (because of the many exceptions under HIPAA, FERPA and State law).

60. Tuesday, February 11, 201460 Privacy Laws and EHDI: Recommendations continued What a FERPA-specific consent form needs to specify: What EHDI will disclose to the Part C lead agency (e.g., the results of the hearing screening). The Part C/EI service referral form should be very specific to the Part C program. What the Part C lead agency will disclose (e.g., evaluation results) and whether the child is determined eligible under Part C. If the consent says the EHDI program will obtain information from the lead agency after referral to Part C, it also needs to specify that information cannot be redisclosed under FERPA.

61. Tuesday, February 11, 201461 Privacy Laws and EHDI: Recommendations continued Each State has specific needs and statutes. Therefore, contact the attorney general's office in your state or your agency's general counsel regarding State codes/statutes. Legal questions related to Part C of IDEA can be directed to the Office of Special Education Programs; if related to FERPA, questions can be directed to the compliance office within the U.S. Department of Education. Legal questions related to HIPAA can be directed to the Office of Civil Rights and HHS.

62. Tuesday, February 11, 201462

63. Tuesday, February 11, 201463 Contact Information: Gary Mears, Ed.D. Information Ventures, Inc. 42 S. 15 th Street, Suite 700 Philadelphia, PA 19102 (215) 569-2300 gary@infoventures.com