Provider Forms

7317-FAQ

Frequently Asked Questions about HIPAA

and the National Immunization Survey

WHAT IS PROTECTED HEALTH INFORMATION?

Protected health information includes all medical records and other individually identifiable information used or disclosed by an entity subject to the Privacy Rule. This would include directly identifiable information such as patient names, and other information such as social security numbers that could be used to identify an individual.

WHY IS THE NATIONAL IMMUNIZATION SURVEY REQUESTING PROTECTED HEATH INFORMATION FROM PROVIDERS?

We have discovered that vaccination information from doctors and clinics is the most up-to-date and comprehensive and that the quality of the study's results is much improved by combining the information given by households with that given by these medical providers. It is important that we obtain the most reliable information possible about children's vaccinations so that we can provide the public with reliable information about vaccination rates.  

HOW DOES THE PRIVACY RULE ALLOW PARTICIPATION IN THE NIS?

Please be assured that your participation in the National Immunization Survey is allowed by the Privacy Rule, as stipulated in the Health Insurance Portability and Accountability Act (HIPAA). Disclosures of patient data are permitted for public health surveillance purposes. A Privacy Board at the Centers for Disease Control and Prevention has also reviewed this study. In addition, a parent or guardian has given verbal authorization for the release of the child’s immunization history to us. Documentation of this verbal consent will be included in the request for immunization data.

The Centers for Disease Control and Prevention (CDC) has provided and made available on their website the material you may need to verify, under Privacy Rule requirements, that you are permitted to disclose to the CDC the information requested in this survey. The protected health information requested is the minimum necessary to accomplish the objectives of the study. Please see: www.cdc.gov/vaccines.

ARE PROVIDERS REQUIRED TO COMPLY WITH THE HIPAA PRIVACY RULE?

Health care providers who transmit financial and administrative health information electronically must comply with the Rule as of April 14, 2003. For example, if you submit claims electronically, you would be required to comply with the Rule.

WHAT DO I HAVE TO DO TO COMPLY WITH THE PRIVACY RULE?

Accounting of disclosure is required should patients inquire about disclosures of protected health information. There are several things that would assure that you comply with the Rule when participating in the survey. First, the privacy notice that you provide to your patients must indicate that patient information may be disclosed for research or public health purposes. You will also need to keep track of disclosures made for this survey. The Census Bureau will provide you with all of the necessary documentation you need to keep track of the disclosures. The documentation will include CDC as the public health authority to which the access was given, a description of the records and health information accessed, the general purpose for the disclosure, and when access was provided.

WHY DO I HAVE TO ACCOUNT FOR THESE DISCLOSURES?

Under the Privacy Rule, patients have a right to an accounting of disclosures that have been made of their identifiable information for various purposes, including disclosures for public health and research purposes.

DOES THE PRIVACY RULE REQUIRE A NOTATION IN EACH MEDICAL RECORD THAT HAS BEEN ACCESSED BY PUBLIC HEALTH AUTHORITIES?

The Privacy Rule does not require a notation in each medical record that has been accessed by public health authorities, as long as the information required under the Privacy Rule is included in the accounting for disclosure. The Health and Human Services Office of Civil Rights does not recommend placing this information in each medical record. Should your practice want to place a notice in the child’s record, the Census Bureau will provide these notices for you.

WHY SHOULD YOU USE THE ACCOUNTING NOTICES PROVIDED BY THE CENSUS BUREAU?

To maintain confidentiality under the Census Bureau’s Title 13 authority, only persons with Special Sworn Status can know the identity of the children who are participating in this survey. The accounting notices provided to you will not refer to the specific survey the child is participating in, but will generally state that the records were accessed by the CDC.

WHAT IF I WANT MY INSTITUTIONAL REVIEW BOARD (IRB) TO REVIEW THIS PROJECT?

Your IRB could verify that the documentation we have provided adheres to the requirements of the Privacy Rule under HIPAA.

WHERE CAN I FIND THE REQUIREMENTS OF THE PRIVACY RULE?

A summary of the Privacy Rule can be found at http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf

The following parts of the rule were referred to above:

Disclosures without patient authorization – 45 CFR 164.512

Disclosures for public health activities – 45 CFR 164.512(b)

Disclosures for research purposes – 45 CFR 164.512(i)

Verification requirements – 45 CFR 164.514(h)

Privacy notice – 45 CFR 164.520

Accounting of disclosures – 45 CFR 164.528

Minimum necessary requirements – 45 CFR 164.502(b) and 45 CFR 164.514(d)

HIPAA guidelines are also available at the following websites:

http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/publichealth/index.html

http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/research/index.html

UNDER WHAT AUTHORIZATION DO YOU COLLECT THIS INFORMATION?

This study is authorized by Title 42, United States Code, Sections 306 & 2102(a)(7) of the Public Health Service Act and by The National Childhood Vaccine Injury Act of 1986. Legal authorization for the Census Bureau to conduct this study is granted by Title 13, United States Code, Section 8. The information you supply will be treated confidentially, as specified by law in Section 9 of Title 13. We will not release any information that could identify you, your practice, your facility, the child, or the child's family. The information will be used for statistical purposes only.

DO I HAVE TO PARTICIPATE?

The survey is voluntary, and there are no penalties for not participating; however, we hope that you will choose to participate. We expect that it will take about 15 minutes to complete an Immunization History Questionnaire for each selected child in your practice. Your actual time may be somewhat shorter or longer than this depending upon the immunization history of the child.

HOW ARE THE DATA USED?

Data from this study will be used for analysis purposes only to determine if the changes made to the survey’s sampling methods and procedures result in improvements to the survey in terms of cost, response, and coverage.