Legal and Policy Barriers to Sharing Data Between Public Health Programs in New York City: A Case Study

Abstract

Integration of public health surveillance data within health departments is important for public health activities and cost-efficient coordination of care. Access to and use of surveillance data are governed by public health law and by agency confidentiality and security policies.

In New York City, we examined public health laws and agency policies for data sharing across HIV, sexually transmitted disease, tuberculosis, and viral hepatitis surveillance programs. We found that recent changes to state laws provide greater opportunities for data sharing but that agency policies must be updated because they limit increased data integration.

Our case study can help other health departments conduct similar reviews of laws and policies to increase data sharing and integration of surveillance data.

State and local laws mandate the reporting of specific infectious diseases to health departments, which, in turn, use these surveillance data to monitor trends, obtain funding, and allocate resources for controlling infectious diseases. Sharing infectious disease surveillance data within a health department is vital to understanding how one disease may place a person at risk for another disease (e.g., HIV and tuberculosis), how characteristics or behaviors may predispose a person to multiple infectious diseases (e.g., enteric infections and sexually transmitted diseases among men who have sex with men), and how diseases may be clustered in specific geographic areas. Understanding these relationships helps health departments and community provider partners integrate education, screening, and treatment programs to save costs and improve population health. In addition, sharing data is critical for routine case investigations and for investigating outbreaks, which are core functions of health departments.¹ The public health need for health department programs to increase data sharing to develop more integrated and cost-efficient systems of care is also in keeping with the goals of the Affordable Care Act.²

Local jurisdictional efforts to integrate surveillance data support the national-level goals of the Centers for Disease Control and Prevention (CDC).³ In 2010, the New York City Department of Health and Mental Hygiene (DOHMH) began implementing CDC’s Program Collaboration and Service Integration initiative.⁴ This initiative aims to strengthen collaboration within health departments across HIV/AIDS, sexually transmitted disease (STD), tuberculosis (TB), and viral hepatitis programs by decreasing duplication of efforts; improving data sharing to better understand and address co-occurrence, coinfection, and syndemics of disease; and facilitating delivery of integrated services to the public. Vital to this initiative are local and state health departments’ commitment and continued efforts to improve data sharing.⁵ Recent CDC guidelines are aimed at increasing data sharing by strengthening and standardizing data security and confidentiality procedures for state and local HIV, viral hepatitis, STD, and TB surveillance programs.⁶

Despite the strong public health rationale for sharing data, several factors affect the ability of health departments to integrate infectious disease data, such as historically siloed funding coupled with the need for technological improvements and resources to implement, update, and maintain an integrated surveillance registry system. Moreover, the state and local laws that authorize the collection of data may actually impede the ability of health departments to share, analyze, and make use of data across separate disease programs.

As part of New York City’s implementation of the Program Collaboration and Service Integration initiative, we carried out a case study to identify factors that affect data sharing, specifically examining the role of public health laws and agency policies on internal sharing of HIV, STD, TB, and viral hepatitis surveillance data.⁷ Our case study focused on HIV, STDs, TB, and viral hepatitis; however, the lessons learned can be applied to other reportable diseases and conditions. This case study can help other state and local health departments to conduct similar reviews of laws and policies to work toward increased data sharing and integration of surveillance data.

SETTING

New York City is the largest and most densely populated city in the United States, with approximately 8.3 million people total and more than 27 000 per square mile.⁸ New York City also has a large burden of infectious diseases: 3599 cases of HIV/AIDS,⁹ 711 cases of TB,¹⁰ 10 212 cases of hepatitis B, 9924 cases of hepatitis C,¹¹ 63 544 cases of chlamydia,¹² 12 354 cases of gonorrhea,¹³ and 955 cases of primary and secondary syphilis¹⁴ were newly reported in 2010. With an annual budget of $1.54 billion and nearly 5000 employees, DOHMH is the largest nonfederal public health agency in the United States.¹⁵

In many states and large cities, separate administrative units oversee different groups of diseases, and data are stored and maintained in separate databases. The Division of Disease Control at DOHMH houses separate infectious disease programs for HIV/AIDS, STDs, TB, immunizations, and general communicable diseases (including hepatitis B and hepatitis C). Laboratory and provider reports of infectious diseases are submitted to DOHMH, and all electronic reports are processed through a secure, common electronic information system. Individual programs receive data that have been parsed according to their specific area of program responsibility. Access to those reports and use of the data are limited by disease-specific public health laws and by security and confidentiality policies in the agency. Therefore, it is critical to understand permissible uses of data according to these regulations and to identify any necessary changes to increase data sharing and integration.

DATA SHARING

CDC defines data sharing as “granting certain individuals or organizations access to data that contain personally identifiable information.”¹⁶ We examined 2 types of data sharing. First, data from 1 or more years can be merged to conduct retrospective epidemiological analyses; for example, linking the hepatitis C and HIV registries to determine how many people living with HIV also have a report of hepatitis C in New York City. Second, data can be shared in real time to help with a specific public health activity or to improve completeness of another disease program’s data; for example, if the STD program has the phone number of a person previously reported to have an STD, who needs follow-up for a TB screening, but the TB program does not have valid contact information, the phone number from the STD report could be added to the TB report to facilitate the necessary contact.

Both types of sharing rely on the use of identifying information such as a person’s name, phone number, or date of birth. In the first category, the identifying information is used to link records and not for any other purposes. Findings are presented in the aggregate with no possibility of identifying a specific individual. Data suppression strategies are employed before the release of data findings to protect confidentiality.¹⁷ In the second category, identifying or disease information is retained for use. Overall, data sharing serves a myriad of purposes for state and local health departments, including partner–contact management, assessment of coinfection and syndemics, quality-of-care assurance, program planning, and investigation of specific public health research questions.

LEGAL LANDSCAPE

Disease surveillance is generally regulated by state and local laws, which vary widely.¹⁸ At the federal level, the Health Insurance Portability and Accountability Act governs the confidentiality of patients’ medical information. Although the Act permits medical providers to report patient disease information to public health agencies without patient consent under section 1178(b),¹⁹ it does not address how a public health agency may use, maintain, and disclose those data.²⁰ Policies are governed by state and local law as well as by agencies' internal operational policies and procedures.

In New York City, public health agency data use is regulated by the New York State public health law, the New York State sanitary code, and the New York City health code. Laws and regulations for reporting and disclosing case information came into existence at different times, driven by specific needs, such as the recognition of a new public health problem. Data confidentiality was addressed in different ways, depending on the prevailing standards at the time and the need to collect and use specific disease information.²¹ The result is an array of diverse laws regarding access to confidential information and its subsequent use, a patchwork of legal authority that does not necessarily reflect how the health department needs to operate to fulfill its broad mission of protecting public health. In New York City, the separate historical laws on HIV and STDs created a situation in which sharing surveillance data between programs, even within a single health department, constituted an impermissible disclosure of confidential disease information.

HIV

The New York State legislature first enacted a separate chapter of the Public Health Law covering HIV disclosure, partner notification, and confidentiality in 1998. Until the law was amended in 2010, information from HIV case reports in New York State could only be used for epidemiological monitoring (i.e., counting cases and describing aggregate characteristics) and partner notification (i.e., notifying sexual partners of infected persons that they may have been exposed to HIV).²² In practice, this meant that each request for access to the HIV registry, even from within the health department, had to be assessed on a case-by-case basis to evaluate whether the proposal constituted a permissible use. Linkage between disease surveillance registries was only allowed for epidemiological monitoring, thus permitting retrospective analyses. The 2010 amendment expanded this statute and permitted additional internal uses of HIV registry information by public health disease programs, including assessment of comorbidity, completeness of reporting, and “to direct program needs.”²³

HIV case information can also be used to evaluate the quality of care by agencies contracted by state or local government to provide health care or other services.²⁴ Therefore, the HIV surveillance programs in New York State health departments can now share individual-level HIV data with another program in the same health department for a wider array of public health activities. The 2010 amendment was a major step toward improving public health by allowing critical HIV-related information to be used for broader purposes within the health department.

Sexually Transmitted Diseases

Until early 2013, the relevant New York State law for STDs, originally passed in 1918, only stated that “[a]ll reports or information secured by a board of health or health officer under the provisions of [the STD article] shall be absolutely confidential except in so far as is necessary to carry out the purposes of the article.”²⁵ The “purposes of the article” were defined narrowly as STD control and treatment. Under the New York City health code, individually identifiable STD-related surveillance data collected by DOHMH are confidential and should not be redisclosed,²⁶ with a general exception for disclosing information to “a physician or institution providing examination or treatment . . . to an agency approved by the health department for prevention, treatment or social service, or to any person when necessary for the protection of public health.”²⁷ Reading the New York City health code and the New York State law together, DOHMH lawyers concluded that sharing STD data (individual named disclosures) from one program within DOHMH to another program, or to an outside entity, could be done only if the purpose for disclosure was directly related to the care and treatment of the STD, and not for other real-time public health activities, such as providing information to complete another disease report (e.g., hepatitis C surveillance data), or any other public health purpose.²⁸

The New York State law was amended in early 2013 to add language that mirrors that of the New York State 2010 HIV amendment, such that uses including assessment of comorbidity, completeness of reporting, and disclosures “to direct program needs” are now permissible.²⁹ Efforts are under way to identify and implement changes to agency policies to permit greater flexibility for sharing of STD data with other disease programs.

Tuberculosis and Viral Hepatitis

Mandatory reporting of TB in New York City began in 1897.³⁰ Currently, disclosure of TB data from DOHMH is governed by the same city health code provision as STDs, such that disclosures outside DOHMH or the New York State Department of Health are generally not permitted.³¹ New York State law, however, permits the department to disclose identifiable TB information if it is authorized in the state sanitary code.³² Under a provision specific to TB, the New York State sanitary code allows health officers to use their own judgment to determine whether disclosure of private information is in the best interest of a patient or the patient’s family and whether disclosure will contribute to the protection of public health.³³ This is less restrictive than the New York State STD law even after the change in 2013. Unlike the disease-specific language in the HIV and STD laws, “protection of public health” is a broad and flexible standard and permits justifiable disclosure of TB information to other disease surveillance groups in DOHMH.

Viral hepatitis reporting and confidentiality are governed by general New York State and New York City provisions for communicable diseases. The relevant city law is the general confidentiality law that applies to most reportable diseases and conditions.³⁴ These general provisions permit broad public health use in DOHMH as well as by the State Department of Health but limit inspection by others. “Appropriate information” can also be shared broadly “when necessary for the protection of public health,” as long as it is the “minimum necessary.”³⁵

INTERNAL POLICIES

Public health laws provide the foundation for internal institutional health department policies and surveillance systems; internal policies cannot be less restrictive than public health laws, but they can be more restrictive. Even where there are no specific legal restrictions on the use of data, internal health department policies are needed to protect the security and confidentiality of identifiable health information and to ensure that data are only shared when there is a public health justification. Basic tenets of any such policy are that confidential data should be shared only with those who have a need to know and should contain only the minimum information necessary. Infectious disease programs in DOHMH, with the exception of HIV, have moved to 1 common software program to manage surveillance data, but each program maintains a separate database. The technology now exists in DOHMH’s information infrastructure for case information to be electronically shared between programs. This infrastructure was set up to follow the public health laws prior to 2010, but to ensure that confidentiality is protected, additional internal policies limit access to and use of the data.

Electronically transmitted disease reports are received initially by a single application, which parses data according to standardized rules and forwards data to each program’s individual database. During development of this electronic information system, DOHMH officials placed restrictions on disease programs’ ability to routinely access other programs’ data in their entirety. Unlike demographic information from a case report, which can be accessed through an electronic look-up function, disease information is not available to any other program, even where there is no legal restriction. This is in accordance with the principle that access to sensitive information should only be on a need-to-know basis. Under current agency policy, demographic data originating in the TB registry can be accessed by the STD program, but disease information is not available. For example, patient race/ethnicity and address from a TB report are accessible to the STD program if the patient also has an STD report, but TB disease status is not available, nor is there anything to indicate that the demographic information came from a TB report. In addition, each program controls access to its own disease-specific data according to job functions; that is, access to data is restricted even within a program. In these instances, the internal agency policies are stricter than what the law permits for sharing data.

When the new disease-reporting infrastructure was first planned, HIV data were not included because of the limited permissible uses under the original law, prior to the 2010 amendment. STD data were included in the new system; however, the functionality did not allow for demographic data originating with an STD case to be accessed by any other program. In the wake of the legal expansion of HIV and STD data uses in 2010 and 2013, efforts are under way to make some HIV and STD data available in the common infrastructure. Increasing data sharing and data integration is therefore predicated on both a legal and a policy review that need to take place prior to any technological changes that make data more widely available through the electronic infrastructure. Once a system has been implemented, proposals to increase data sharing require a reevaluation of laws and policies to ensure that the sharing is permissible. Changes to the electronic infrastructure to increase data sharing are possible, but they can be resource and labor intensive.

IMPACT OF LAWS AND INTERNAL POLICIES

Merging data from disease surveillance registries to conduct epidemiological analyses is a use that is sanctioned by all New York State and New York City laws and current internal DOHMH policy. Confidentiality is carefully protected during data linkage, analysis, and reporting or release of any data.³⁶ Although technological changes could make these data matches more efficient, they are already permissible and regularly take place at DOHMH.³⁷

The second main use for data sharing is to conduct public health activities that require retaining potentially identifiable individual information. This type of data sharing potentially creates conflicts with existing laws or agency polices. The 2010 change to the New York State HIV law and the 2013 change to the New York State STD law allow further uses of surveillance data by DOHMH, easing the legal restrictions on internally sharing surveillance data in New York City. The changes in these 2 laws are important steps toward increasing data integration.

Remaining challenges to increasing the sharing of HIV and STD data and other infectious disease data are related to internal policies and technological capacity. The ability of a program to view in real time an individual’s disease information for a disease report generated by another program is still prohibited by internal policy, and enforced through restricted electronic access. For example, the TB program could benefit from real-time access to HIV information in the event that patients refuse testing and do not disclose their status because this affects what medications should be used to treat the TB. Increasing data sharing has clear value, from both a public health and an efficiency perspective.

LESSONS LEARNED

Disease surveillance programs can improve their efficiency and quality of population health assessments by merging and analyzing surveillance disease data, but the experience in New York City has 2 important lessons that all health departments need to take into account. First, public health laws may be outdated and require change. In New York State, it took several years to change the HIV and STD laws, though it ultimately opened up broad possibilities for analysis when the term “program needs” was included under acceptable uses of the data. Technology now permits linkage of data in real time and enables extensive epidemiological analyses, which support the public health goal of improving population health. Jurisdictions that want to merge and analyze their data, with a focus on real-time data sharing, will need to conduct similar legal analyses. The 2011 CDC Data Security and Confidentiality Guidelines is an important source of guidance for state and local health departments to take action to increase data sharing and integration.³⁸ Although a federal agency’s guidance cannot supersede more restrictive state or local laws, this document sets forth important national standards that can be used at the state and local levels to demonstrate both the importance of data sharing and the ability to protect individual privacy.

The second lesson is that protecting the confidentiality of sensitive health information becomes more challenging when the volume of data increases and technology advances, but it should remain of the highest priority for health departments. Rapid changes in health care institutions’ use of information technology mean that health departments will receive sharply increasing volumes of data. Disease surveillance, a core function of health departments, is only possible if patients, clinicians, and laboratories can be confident that the data they are reporting are confidential and secure. If such confidence is lost and the credibility of the health department is questioned, proposed legal changes will be hindered and the accuracy of surveillance data will likely suffer. Although departments should analyze all disease surveillance data to improve understanding of population health, departments must also use the latest available technology to maintain strict access controls and audit use to ensure that persons reviewing data have the requisite permission and need to know. Overall, understanding these processes may help other health departments conduct similar analyses and support increased efforts to integrate disease surveillance data.

The need for better coordination and integration of public health surveillance data within health departments mirrors the health reform goal of cost-efficient coordination of care in the health care delivery system.³⁹ The technological capacity for sharing patient data while protecting privacy is better than ever. Many more types of data sets could be linked with health department surveillance data to inform public health planning, such as health care service utilization data, social service program data, and other data sets external to health departments. The ongoing assessment and improvement of data systems is necessary but challenging and must take into account permissible uses under state and local laws as well as agency policies that should reflect best practices. To the extent that laws or historical policies stand in the way of this aim, health departments can identify those barriers and make the case for change.