2. The Challenge of Applying HIPAA to Public Health's Traditional, Non-covered Programs

In April 2016, the US Department of Health and Human Services launched the Public Health 3.0 initiative. Public Health 3.0 envisions public health authorities collaborating with other entities across sectors to develop “timely, locally relevant health information systems” that “address all factors that promote health and well-being.”^{Reference DeSalvo5} This opens new challenges to privacy and ethics as public health authorities seek to gain access to a broader array of personal health information from providers or payers, to link with new partners' data sets, for new purposes. Additionally, community groups seek timely and relevant data about their constituencies at a more granular level than ever before.

Among its many requirements, HIPAA prohibits the use and sharing of individually identifiable health information, unless the proposed use or disclosure is specifically permitted or required under the HIPAA Privacy Rule (“the Rule”).⁶ The Privacy Rule's “safe harbor standard” is the most commonly utilized HIPAA compliant de-identification method, as it is straightforward and specifies prohibited data elements that directly identify a person, such as name, Social Security number, and medical record number.⁷ HIPAA also generally requires redaction of dates that are more specific than a year and geographies that are smaller than a state.⁸ The downside to this method is that it yields a dataset that does not include granular, place-based, temporal data that is useful to communities. Consequently, when public health shares data that has been de-identified according to the HIPAA safe harbor standard, it may not be able to fully achieve the Public Health 3.0 vision.

Even though HIPAA exempts information sharing for basic public health functions, the complex political and business arrangements that vary by jurisdiction can make determinations of law difficult, and mistakes can be costly⁹ — and chilling. Too often, legal counsel will suggest that the safest route is “locking down” data that should be available, to avoid liability for improperly navigating law or unintended or unforeseen disclosures. While HIPAA is an important safeguard in the health sector, public health entities have a duty to ensure that it does not pose a barrier to working across sectors to fulfill their essential functions for the public good. We propose strategies below.

3. Communities Need Timely and Locally Relevant Health Data

While public health authorities have a host of traditional functions in epidemiology, surveillance, and population-level intervention that are greatly enhanced by technology, a true understanding of SDOH and the associated inequities that are major drivers of morbidity and mortality must include input from people with lived experience in the populations most affected. This is important in understanding the meaning of the data collected, the development of effective interventions, and evaluating true impact. At the same time, many other community health stakeholders — from hospitals to insurers to community leaders — are beginning to understand the potential for public health data to strengthen their own work, whether it is driven by community benefit regulations, payment reform, or civic engagement. Sadly, lack of understanding of technology and regulation dampens the flow of useful information even as the volume, timeliness, and granularity of health data increases exponentially. While it is difficult to develop empirical evidence of what did not happen (cases where data should have been shared but were not),^{Reference van Panhuis10} there is growing alarm that this lack of understanding can lead to missed opportunities for community health improvement when stakeholders believe that HIPAA constrains their ability to share and use data.^{Reference Wartenberg and Thompson11}

When the right combination of data literacy, infrastructure, and trust exists, innovative partnerships can lead to real health improvements. When it does not, the results can be disastrous. Lack of access to surveillance data at a geographic or demographically precise level can lead to unrecognized epidemic or endemic situations. In the case of Flint, Michigan's water crisis, while the levels of system failures and responsibilities continue to be debated — and litigated — the situation might have been resolved sooner had blood lead level test results from public health surveillance been more readily available to local doctors. Dr. Hanna-Attisha, who eventually verified the problem using data from her hospital's medical records, has said that she believes that the problem need not have gone on so long. “I tried to get that blood lead data both from the state and from the county health departments but had roadblocks at every direction.”^{Reference Hana-Attisha12}

Epidemiology and service utilization information can also be important to communities. Community-based organizations often want better enforcement of housing standards but can have a hard time convincing authorities to act. In some areas, these groups have worked with the public health sector to identify clusters of pediatric asthma in neighborhoods with poor housing. Looking for patterns in hospitalizations can further help to understand what exacerbates housing-related health conditions to even more dangerous levels. Demonstrating that children living in apartments without adequate air conditioning visit the emergency room more often can galvanize action by health systems as well as municipal authorities, but it takes extremely granular data to make the case.

4. HIPAA's Hybrid Entity Policy Option

Applying HIPAA's use, disclosure, and de-identification regulations to traditional public health data sharing prevents communities from accessing needed data from vital statistics, registries, surveillance, interventions, and investigations. HIPAA does not intend this result and does not list traditional public health activities within its scope.¹³ Moreover, the Rule offers a mechanism to carve out non-covered functions, such as traditional public health programs, from the rest of the organization, so that HIPAA only applies to those portions of an organization that the law specifically lists as covered, such as a public health laboratory that bills electronically or a Children's Health Insurance Program. This policy option is known as becoming a hybrid entity.¹⁴

Becoming a hybrid entity requires research and assessment to identify the legal entity within which the public health department sits.¹⁵ It also requires an evaluation of services against HIPAA to determine which parts of the organization provide covered services.¹⁶ The assessment results must be reflected in writing, commonly referred to as a hybrid entity policy, and maintained for six years.¹⁷ HIPAA offers the hybrid entity policy option so that organizations, including public health departments, may strategically and legally limit the application of HIPAA, thereby exempting traditional public health programs from its reach.¹⁸

Vital statistics about overdose deaths reveal the problem generally, but understanding the local environment is essential for action. As an example, Indiana State Department of Health's (ISDH) syndromic surveillance system (Essence) captures drug overdose activity. ISDH launched a pilot project to monitor trends and alert local health partners regarding increases in overdoses.^{Reference Billman and Dotson19} Examples of available data fields include: patient zip code and county of residence, hospital name, county and zip code, date and time of patient arrival, and chief complaints.²⁰ ISDH safeguards individual privacy by only releasing deidentified data to authorized individuals who have signed their agreement.²¹

Because ISDH chose to be a hybrid entity under HIPAA, it removed its syndromic surveillance program from HIPAA's reach and is legally able to share granular and timely overdose syndromic surveillance data with local health departments and other partners. If ISDH had not become a hybrid entity, its syndromic surveillance program would be covered by HIPAA because of its other HIPAA-covered programs - Breast and Cervical Cancer Program, Children's Special Health Care Services Program, Genomics/Newborn Screening Program, Hemophilia Program and HIV Medical Services Program.²² In the absence of meeting a HIPAA exception and without access to a statistical expert, if ISDH's overdose syndromic surveillance system were HIPAA covered, it would generally not be able to share the detailed dates and time (anything less than a year) and geographic data (generally any subdivision smaller than a state) with partners beyond the local health departments.²³ The power of ISDH's overdose syndromic surveillance would not be maximized.