The Role of Law in Supporting Secondary Uses of Electronic Health Information

Introduction

For decades, health information has been collected and shared for health care delivery and public health purposes. While the “primary use” of patient data for providing direct health care services is the cornerstone of health care practice, health departments rely on data sharing for research and analysis to support disease prevention and health promotion in the population.¹ As the U.S. health system undergoes a digital revolution, health information that was previously captured in paper form now can be captured electronically. Electronic health information (EHI) has transformed the efficiency, capacity, and functions of the U.S. health system.² For this reason, there is increased attention to the “secondary use” of electronic patient data for public health uses,³ including disease reporting and investigation, syndromic surveillance, and patient-specific or population-level communications about health conditions and their associated risk factors. Secondary uses may also encompass clinical research, licensure, and payment for services.

Laws play an instrumental role in facilitating the recording and sharing of health information and granting protections to patients and providers. However, the transition from paper to electronic health information systems pose challenges to the legal environment surrounding health data.⁴ Laws governing access to and disclosure of EHI for secondary uses describe the type of information that can be shared and whether it identifies individual patients, the types of entities sharing the information, and the reasons for which the information is shared.⁵ As the implications and challenges of EHI are understood, states are updating laws that once supported paper health records to include electronic health records (EHRs) and the secondary use of data. This article provides an overview of laws supporting secondary use of EHI data for public health purposes, the state law landscape surrounding the transition from paper to EHI systems, and legal tools available for public health uses of EHI.

Federal Law Supporting the Implementation of EHI for Secondary Uses

Federal law establishes the foundation for secondary uses of EHI. Privacy and security provisions control the access, use, and disclosure of individually identifiable health information, and meaningful use provisions promote the use of health information technology (HIT) and EHRs among health care providers and patients.

The purpose for disclosure is central to existing and future secondary uses of EHI. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule⁶ defines protections for health data acquired for primary uses, while also permitting certain secondary uses for public health purposes. Providers may disclose protected health information (PHI) identifying patients without their authorization to a public health authority for purposes of preventing or controlling disease, injury, or disability under the public health exemption, or if required by law.⁷ For other public health uses, providers may share a “limited data set” with treatment dates and zip codes, though providers may re-identify patients for public health alerts or case reports.⁸ HIPAA also permits health care entities to use PHI for other potential secondary uses like quality assessment and improvement.⁹

As the implications and challenges of EHI are understood, states are updating laws that once supported paper health records to include electronic health records (EHRs) and the secondary use of data. This article provides an overview of laws supporting secondary use of EHI data for public health purposes, the state law landscape surrounding the transition from paper to EHI systems, and legal tools available for public health uses of EHI.

Federal monetary incentives encourage the “meaningful use” of HIT by providers and facilities and support state-based health information exchange for secondary uses.¹⁰ The Health Information Technology for Economic and Clinical Health Act of 2009 specifies that meaningful use should embrace the goal of improving population health outcomes.¹¹ Centers for Medicare and Medicaid Services rules set up graduated requirements for receiving incentives, including the adoption of certified, interoperable EHR technologies and data sharing for specific secondary uses, such as syndromic surveillance, health information exchange, or population health.¹² To enable providers and facilities to attain these goals and advance secondary use of data, states are revising laws governing collection and sharing of health data.

State Law Landscape Surrounding the Transition to EHI

State laws are transitioning to support the use of EHI for primary and secondary uses, particularly by health departments. State EHI laws provide authorizations for public and private entities to share data, impose requirements for the collection and storage of data, and outline consequences for non-compliance. Variations in state EHI laws will affect how health departments in many jurisdictions fulfill their essential public health functions, as well as the extent and impact of cross-jurisdictional or national use of EHI. CDC’s Public Health Law Program (PHLP) leads research on EHI uses that are important to essential health department functions, and seeks to describe the landscape of state EHI laws through a 50-state assessment on primary and secondary use.¹³ PHLP’s research describes broad categories of primary use of data by health care providers, schools, and correctional facilities. Provisions related to secondary uses capture reporting requirements, registries, reimbursement policies, and mechanisms external to the health department.

Data collected from a recent assessment of state laws illustrate important variations in permissible EHI usage. The assessment examined 12 geographically-dispersed states and categorized the relevant legal provisions into three primary uses and 25 secondary uses. No single state’s laws included every use category identified. Among the 12 states, all provided for primary use of EHI by providers or facilities. Laws enabling secondary uses were not as uniform. EHI provisions linked to vital statistics in 11 states, immunization information systems in 8 states, and cancer registries in 5 states. Nine states had health information organizations or exchanges, and 11 referenced the use of EHI by payers.¹⁴

The laws assessed reflect that states are using EHI differently and increasingly across government functions. For example, states are using laws to authorize the combination of discrete data sets, as when integrating vital statistics and immunization data in electronic registries and health information exchanges. States permit the use of EHI to better understand the quality of health care delivered regionally and at specific facilities and establish the authority and operation of health information organizations specializing in health information exchange. These provisions reflect marked differences from the laws governing paper records.¹⁵

Early evidence suggests that state laws vary widely in addressing health information generally, in addition to specific HIT and secondary uses of EHI. Reflecting these differences, state health departments may rely on legal tools to supplement existing legal authorities and support data sharing for public health.

Legal Tools for Secondary Uses of EHI to Support Public Health

Legal tools, such as institutional policies and contracts, can sustain secondary uses by aligning data exchange and technological or functional capabilities between certain parties. Data use agreements (DUAs), business associate agreements (BAAs), the federal Data Use and Reciprocal Support Agreement (DURSA), computer matching agreements, and interservice and intra-governmental memoranda of understanding (MOUs) are options for governing access, use, and disclosure of EHI between organizations and jurisdictions. As with any policies and contracts, the application of these legal tools must be consistent with the applicable statutes and regulations governing primary and secondary uses of EHI.

Some laws or systems established by laws may require formal agreements between institutions. Laws may require providers and facilities to maintain DUAs for activities like syndromic surveillance that permit sharing information from a limited data set without patient authorization.¹⁶ DUAs can be used to facilitate both primary and secondary uses of PHI and deidentified information.¹⁷ Entities must agree on who will share data and who will receive it, promise that the data will not be disclosed further, and ensure that the recipient will not re-identify patients from the data. These data may be used for voluntary public health surveillance and patient notification if a health department receiving data supplies a re-identification code to the contracting provider, who then re-identifies the patient and takes action.¹⁸ DUAs may allow data to be further disclosed for research and healthcare operations.

Laws may also require providers and facilities to contract with business associates to create safeguards that protect PHI.¹⁹ A business associate is an entity contracted to perform services using PHI on behalf of a HIPAA-covered entity, such as data analysis, utilization review, and billing.²⁰ Business associate agreements can facilitate the sharing of discharge data, clinical quality data such as adverse events, and claims data with public and private payors, and hybrid public health entities that use that data for health care quality review.

Because laws may not cover the technical details or infrastructure involved in the exchange of data, agencies and facilities may need other assurances that systems are in place and mutually understood. DURSA is a multi-party legal agreement that governs the standards, services, and policies related to web-based EHI shared between providers and facilities and the federal government through the Nationwide Health Information Network Exchange. All entities, organizations, and federal agencies that sign DURSA voluntarily agree to the framework of responsibilities, obligations, and expectations to promote safe and secure electronic health information exchange.²¹ Providers and facilities that sign DURSA can exchange summary patient records for care coordination and disability determination with the Social Security Administration and submit state public health reporting information to CDC.

Laws can support agency or institutional policies that hold facilities or agencies responsible for certain activities through independent agreements. The Computer Matching and Privacy Protection Act of 1988 requires written agreements to establish safeguards to protect PHI matched by computerized matching programs.²² Computer matching agreements permit federal agencies to verify that reimbursements from government benefit programs are accurate. State agencies also use computer matching for many data sharing functions, such as managing payroll records or verifying eligibility for federal benefit programs.

Differing laws between jurisdictions may necessitate extralegal agreements, especially for interstate EHI sharing. MOUs between governments and organizations for data and services can help increase the capacity of health departments to use EHI for emergency response activities, including responses to pandemic influenza, terrorism, and natural disasters.²³ MOUs allow public health agencies to collaborate with law enforcement agencies, corrections systems, the judiciary, and other sectors to share PHI and de-identified data for public health emergency response and preparedness. Through these various legal tools, the legal environment surrounding the sharing and analysis of EHI for public health purposes can be strengthened to support the latest HIT policies and architectures.

Conclusion

Effective sharing of EHI for secondary uses can support public health activities and cross-jurisdictional collaboration. While this article presents ongoing legal efforts to address the sharing of EHI for secondary uses, it remains to be seen whether the law will evolve at a pace commensurate to that of HIT. Topics for future research may address how law (1) incorporates where information is stored, including in facilities, regional health information organizations, or the cloud; (2) standardizes how information is stored and presented; and (3) impacts the sharing and analysis of EHI with public health agencies to better serve both providers and patients.