| Disclosure to Immunization Registries under the HIPAA Privacy Rule |
|
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) governs the
use and disclosure of protected health information. It applies to:
- Health plans and providers (“covered entities”)
- Business associates of who perform legal, accounting or other services for covered entities
HIPAA Section 164.512(b) permits a covered entity to
disclose protected health information for public health activities. |
| Impact of HIPAA on immunization registries: |
HIPAA does not govern immunization registry activities because the Privacy Rule permits disclosure to public health authorities and their authorized agents for public health purposes.
- Public health authorities operate ALERT in Oregon.
- Oregon state law allows the sharing of ALERT information with authorized users.
[ORS433.090-102]
|
| Impact of HIPAA: clinic and health plan release of immunization data to ALERT: |
Clinics can send electronic or barcode immunization data to
ALERT:
- Covered entities (providers, clinics, health plans) may disclose protected health
information to ALERT without having to get advance permission from patients. HIPAA Section 164.512(b).
- ALERT can re-disclose immunization information to authorized users in accordance
with Oregon state law [ORS433.090-102].
- ALERT staff will work with clinics and other covered entities
to ensure that file transfers are protected.
|
| Impact of HIPAA: accounting for public health disclosures: |
- A simplified accounting for Public Health purposes may be used if during the accounting period the covered entity made multiple disclosures to the same recipient for the same purpose. In such cases, the covered entity need only identify the recipient [ALERT] of such repetitive disclosures, the purpose of the disclosure, and describe the protected health information [immunization
records] routinely disclosed.
- The date of each disclosure need not be tracked. The covered entity would not need to annotate each patient's medical record whenever a routine public health disclosure was made.
MMWR April 11, 2003/ 52; Pg.9.
Please contact Mary Beth Kurilo
if you have any questions about the impact of HIPAA and Oregon’s immunization
registry.
|
