Provider Forms

Attachment P 7317-FAQ

Frequently Asked Questions about the National Immunization Survey Including HIPAA Compliance and Title 13

WHY IS THE NATIONAL IMMUNIZATION SURVEY (NIS) REQUESTING IMMUNIZATION INFORMATION FROM PROVIDERS?

Vaccination information from doctors and clinics is the most up-to-date and comprehensive and the quality of the study's results is much improved by combining the information given by households with that given by medical providers. It is important that we obtain the most reliable information possible about children's vaccinations so that we can provide the public with reliable information about vaccination rates.

WHAT IS THE DIFFERENCE BETWEEN TITLE 13 AND THE HIPAA PRIVACY RULE?

Title 13 of the United States Code is the authority under which the Census Bureau is conducting this survey. Like the HIPAA Privacy Rule, it ensures the confidentiality of medical information connected with the name of any patient. However, it additionally requires that the identity of a patient in the survey must remain confidential. Under Title 13 the Census Bureau protects the name and any other identifying information of anyone who participates in the surveys it conducts. Procedures, including the Special Sworn Status form, are in place to safeguard this information. Special Sworn Status is required for anyone in your office who will see the name and date of birth of your patients who are in the NIS. This ensures that when the Census Bureau releases data files to the public that do not contain any identifiable information, no one but those with Special Sworn Status will know which children had participated in the survey. The Census Bureau will not release any information that could identify you, your practice, the patient, or the patient’s family.

HOW DOES THE PRIVACY RULE ALLOW PARTICIPATION IN THE NIS?

Your participation in the NIS is allowed by the Privacy Rule, as stipulated in the Health Insurance Portability and Accountability Act (HIPAA), because disclosures of patient data are permitted for public health surveillance purposes. A Privacy Board at the Centers for Disease Control and Prevention (CDC) has also reviewed this study. In addition, a parent or guardian has given verbal authorization for the release of the child’s immunization history to us. Documentation of this verbal consent will be included in the request for immunization data.

Documentation that can verify, under Privacy Rule requirements, that you are permitted to disclose to the CDC the information requested in this survey is available on their website at www.cdc.gov/vaccines. The health information requested is the minimum necessary to accomplish the objectives of the study.

DOES THE PRIVACY RULE REQUIRE A NOTATION IN EACH MEDICAL RECORD THAT HAS BEEN ACCESSED FOR PUBLIC HEALTH SURVEILLANCE OR RESEARCH?

No, this is not necessary as long as the information required under the Privacy Rule is included in the accounting for disclosure. The Health and Human Services Office of Civil Rights does NOT recommend placing this information in each medical record.

WHY SHOULD I USE THE HIPAA ACCOUNTINGS OF DISCLOSURE PROVIDED BY THE CENSUS BUREAU?

To maintain confidentiality under the Census Bureau’s Title 13 authority, only persons with Special Sworn Status can know the identity of the children who are participating in this survey. The accounting notices provided to you will not refer to the specific survey the child is participating in, but will generally state that the records were accessed by the CDC. Specifically, the HIPAA Accountings of Disclosure we provide for you will include CDC as the public health authority to which the access was given, a description of the records and health information accessed, the general purpose for the disclosure, and when access was provided.

DO I HAVE TO PARTICIPATE?

The survey is voluntary, and there are no penalties for not participating; however, we hope that you will choose to participate. We expect that it will take about 15 minutes to complete an Immunization History Questionnaire for each selected child in your practice. Your actual time may be somewhat shorter or longer than this depending upon the immunization history of the child.

WHAT IF I WANT MY INSTITUTIONAL REVIEW BOARD (IRB) TO REVIEW THIS PROJECT?

Your IRB could verify that the documentation we have provided adheres to the requirements of the Privacy Rule under HIPAA.

WHERE CAN I FIND THE REQUIREMENTS OF THE PRIVACY RULE?

A summary of the Privacy Rule can be found at http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf

The following parts of the rule were referred to above:

Disclosures without patient authorization – 45 CFR 164.512

Disclosures for public health activities – 45 CFR 164.512(b)

Disclosures for research purposes – 45 CFR 164.512(i)

Verification requirements – 45 CFR 164.514(h)

Privacy notice – 45 CFR 164.520

Accounting of disclosures – 45 CFR 164.528

Minimum necessary requirements – 45 CFR 164.502(b) and 45 CFR 164.514(d)

HIPAA guidelines are also available at the following websites:

http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/publichealth/index.html

http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/research/index.html