Georgia epidemiology report, Vol. 20, no. 2 (Feb. 2004)

February 2004

volume 20 number 2

Division of Public Health http://health.state.ga.us
Kathleen E. Toomey, M.D., M.P.H. Director
State Health Officer
Epidemiology Branch http://health.state.ga.us/epi
Paul A. Blake, M.D., M.P.H. Director
State Epidemiologist
Mel Ralston Public Health Advisor
Georgia Epidemiology Report Editorial Board
Carol A. Hoban, M.S., M.P.H. - Editor Kathryn E. Arnold, M.D.
Paul A. Blake, M.D., M.P.H. Susan Lance-Parker, D.V.M., Ph.D. Kathleen E. Toomey, M.D., M.P.H.
Angela Alexander - Mailing List Jimmy Clanton, Jr. - Graphic Designer
Georgia Department of Human Resources
Division of Public Health Epidemiology Branch
Two Peachtree St., N.W. Atlanta, GA 30303-3186 Phone: (404) 657-2588
Fax: (404) 657-7517
Please send comments to: Gaepinfo@dhr.state.ga.us
The Georgia Epidemiology Report is a publication of the Epidemiology Branch,
Division of Public Health, Georgia Department of Human Resources

How Does HIPAA Affect Disease
Reporting To Public Health?
The Health Insurance Portability and Accountability Act (HIPAA), enacted by Congress in 1996, covers not only health insurance portability but also the privacy and security of health information. Congress gave the U.S. Department of Health and Human Services (DHHS) authority to adopt rules to implement HIPAA. What are the implications of HIPAA rules for disease reporting?
1. HIPAA was not intended to affect public health reporting. The comments in the preamble to the HIPAA Privacy Rule explicitly protect state public health laws: "...nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention."
2. HIPAA covered entities (health care providers, health plans, health care clearinghouses) must comply with HIPAA privacy rules as of April 14, 2003. The HIPAA privacy rules are found at 45 Code of Federal Regulations (CFR), sections 160 and 164. Although the HIPAA privacy rules generally preempt state law, they make exceptions. One exception is when state law or rules provide "for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention." (45 CFR 160.203 (c)). This is consistent with the Congressional directive that HIPAA not affect public health reporting.
3. In general, HIPAA privacy rules require covered entities to get patient authorization before disclosing health information (45 CFR 164.508). However, the HIPAA privacy rules provide that for certain disclosures, no authorization is required. Among them: Required by law. Under 45 CFR 164.512 (a)(1), "a covered entity may use ... protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law." Note that per the definition section of 45 CFR 164.501, "required by law means a mandate contained in law that compels an entity to make a ... disclosure of protected health information and that...includes...statutes or regulations that require the production of information..."
The Georgia Epidemiology Report Via E-Mail
To better serve our readers, we would like to know if you would prefer to receive the GER by e-mail as a readable PDF file starting in 2004. If yes, please send your name and e-mail address to Gaepinfo@dhr.state.ga.us.

For public health activities. Under 45 CFR 164.512 (b)(1)(i), "Permitted disclosures. A covered entity may disclose protected health information...to...a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions."
4. The HIPAA privacy rules have a minimum necessary standard in 45 CFR 164.502 (b) that states: "When...disclosing protected health information..., a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." Note, however, under 45 CFR 164.502 (b)(2)(v), that "this requirement does not apply to...uses or disclosures that are required by law, as described by section 164.512(a)...." Further, for public health reporting authorized by law, a covered entity may rely on the Division of Public Health's request to be the minimum necessary, per 45 CFR 164.514(d)(3)(iii)(A), which says that "a covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when...making disclosures to public officials that are permitted under Section 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s) ...."
5. There are a number of provisions in the Georgia Statutes and Rules that require or authorize public health reporting by covered entities. These public health reporting provisions are not affected by the HIPAA privacy rules. Some of these include: O.C.G.A. 31-12-1. Power to conduct research and studies. The Department of Human Resources and county boards of health are empowered to conduct studies, research, and training appropriate to the prevention of diseases and accidents, the use and control of toxic materials, and the prevention of environmental conditions which, if permitted to develop or continue, would likely endanger the health of individuals or communities.

O.C.G.A. 31-12-2. Reporting disease; confidentiality. The department is empowered to declare certain diseases, injuries, and conditions to be diseases requiring notice and to require the reporting thereof..... All such reports and data shall be deemed confidential and shall not be open to inspection by the public; provided, however, the department may release such reports and data in statistical form or for valid research purposes.
O.C.G.A. 31-22-7. Reports to department. The department shall require reporting by clinical laboratories of evidence of such infectious diseases as the department may specify.... No clinical laboratory making reports shall be held liable for having violated a trust or confidential relationship. The reports submitted shall be deemed confidential and not subject to public inspection.
Rule 290-5-3-.04 Liability. Any person, including but not limited to practitioners of the healing arts, submitting in good-faith reports or data to the Department or county boards of health in compliance with the provisions of this Rule shall not be liable for any civil damages therefor.
So, in summary, HIPAA privacy rules allow doctors, hospitals, HMOs, health insurers, and other covered entities to report public health information to the Division of Public Health as in the past, without patient authorization. 45 CFR 164.512 (a)&(b) allows covered entities to continue to report communicable disease information without patient authorization as required by Georgia Statutes and Rules. These provisions of the HIPAA privacy rules allow other public health reporting as well.
For a link to an unofficial compiled version of the HIPAA privacy rules that incorporates the rules as adopted, along with the amendments, go to: http://www.hhs.gov/ocr/hipaa/ finalreg.html.
Additional helpful guidance on HIPAA privacy rule's has recently been released, with a section devoted to public health issues that discusses reporting under HIPAA. Go to: http://www.hhs.gov/ocr/hipaa/privacy.html and click on "public health".
This information has been adapted in part from "HIPAA and Disease Reporting", an article by Dave Orren, Data Practices Coordinator and HIPAA Privacy Official, in the Minnesota Department of Health publication Bug Bytes (November 19, 2002, Vol. 3: No. 14).

-2 -

HIV Reporting in Georgia

Notifiable Disease Reporting

Since the early 1980s, Georgia's Division of Public Health (DPH) has collected epidemiologic information on individuals with AIDS. Those working in HIV prevention and care have found these data invaluable for program planning, setting target populations to be, tracking the epidemic, lobbying legislators, and acquiring funding. But, the field of HIV is constantly changing and challenging us. New therapies have improved the health and lives of many living with HIV and reduced the usefulness of AIDS data. Given the success of HIV care today, many infected with HIV may never be diagnosed with AIDS. Data collected on those with AIDS do not adequately reflect the HIV epidemic. In response to these changes, DPH is implementing HIV Infection Reporting.
Georgia is the final state in the country to begin comprehensive HIV/AIDS reporting, and has been engaged in a 12month process to add HIV reporting to our current AIDS reporting. A plan to collect data has been developed by DPH and reviewed by the public. On December 31, 2003, DPH began HIV reporting.
HIV reporting will allow us to more accurately understand the epidemic in Georgia. Georgia will be able to provide accurate numbers of people infected with HIV and the number living with HIV, and will be able to participate in a new Centers for Disease Control and Prevention (CDC) HIV Incidence Project to estimate the number of new infections occurring each year. Additionally, public health can begin to recruit HIV positive, non-AIDS volunteers for the Supplement to HIV/AIDS Surveillance (SHAS) behavioral interview project. These data will help planning groups better target resources to the most at-risk populations and increase Georgia's ability to receive our share of prevention and care dollars.
Maintaining the security and confidentiality of HIV/AIDS data is a priority for DPH and an important concern for those infected with HIV. HIV/AIDS data never leave our office with identifiers. Identifiable information is not shared with insurance companies, landlords, or other government agencies. The HIV/AIDS Epidemiology office follows strict security and confidentiality guidelines established by the CDC. As we prepare to begin HIV reporting, we are making efforts to further tighten security and further reduce the chance of a breach of confidentiality.
Please visit our website where you can find reports on HIV/ AIDS in Georgia and several documents regarding HIV reporting. Our web address is http://www.ph.dhr.state.ga.us/ epi/aidsunit.shtml.

The Georgia Department of Human Resources, under the legal authority of O.C.G.A. 31-12-2 and with the approval of the Board of Human Resources, has designated certain diseases and conditions notifiable. The purpose of the reportable disease surveillance is to:
1. Identify in a timely way any diseases or conditions that may require immediate public health intervention and follow up;
2. Detect changing trends or patterns in disease occurrence;
3. Identify areas or communities that require special public health response as a result of changes in disease patterns; and
4. Assess and evaluate control and prevention interventions.
In Georgia, public health surveillance is conducted on more than 50 diseases and conditions. The data are collected by local and state health agencies who are responsible for analyzing, interpreting and disseminating the information to "those who need to know" for administrative, program planning, and decision making purposes.
Purpose of Report
The purpose of Notifiable disease Reporting is to document information on reportable diseases in Georgia for health care providers, public health workers, and policy makers. The information is vital to determine the disease burden in Georgia, who is affected, and the public health actions needed to control and prevent disease.
Source of Data
The diseases are reported by county health departments, health district offices, hospitals, clinical and state laboratories, physicians and public and private clinics to the Epidemiology Branch in the Division of Public Health. Cases are reported electronically through the State Electronic Notifiable Disease Surveillance System (SENDSS) at http://sendss.state.ga.us, or by completing a Notifiable Disease Reporting Form (#3095) and mailing in an envelope marked CONFIDENTIAL, or by calling your County Health Department or District Health Office, or the Notifiable Disease Section at 404-657-2588. Population data used to calculate rates were based on estimates generated by the U.S. Census Bureau.

-3 -

The Georgia Epidemiology Report Epidemiology Branch Two Peachtree St., NW Atlanta, GA 30303-3186

PRESORTED STANDARD U.S. POSTAGE
PAID ATLANTA, GA PERMIT NO. 4528

February 2004

Volume 20 Number 2

Reported Cases of Selected Notifiable Diseases in Georgia Profile* for November 2003

Selected Notifiable Diseases
Campylobacteriosis Chlamydia trachomatis Cryptosporidiosis E. coli O157:H7 Giardiasis Gonorrhea Haemophilus influenzae (invasive) Hepatitis A (acute) Hepatitis B (acute) Legionellosis Lyme Disease Meningococcal Disease (invasive) Mumps Pertussis Rubella Salmonellosis Shigellosis Syphilis - Primary Syphilis - Secondary Syphilis - Early Latent Syphilis - Other** Syphilis - Congenital Tuberculosis

Total Reported for November 2003
2003
25 195 12
1 57 190 1 42 41 0 0 2 0 0 0 162 44 2 10 19 13 0 37

Previous 3 Months Total

Ending in November

2001

2002

2003

119

177

107

8278

9014

3457

51

34

34

21

6

4

255

244

237

4715

4894

1914

25

22

9

234

117

363

131

112

176

2

9

5

0

1

1

16

7

5

1

0

1

6

5

2

0

0

0

561

681

722

354

772

213

16

25

18

73

100

53

178

205

83

212

196

81

6

1

0

148

131

114

Previous 12 Months Total

Ending in November

2001

2002

2003

634

657

629

32877

34552

30224

161

127

119

47

45

29

1005

898

862

18324

18946

15256

108

97

61

929

509

796

441

464

670

11

20

30

1

5

13

56

34

29

9

2

3

26

27

20

0

0

0

1699

1968

2013

597

1818

1314

94

110

106

304

329

368

637

745

635

866

776

661

25

14

10

579

603

492

* The cumulative numbers in the above table reflect the date the disease was first diagnosed rather than the date the report was received at the state office, and

therefore are subject to change over time due to late reporting. The 3 month delay in the disease profile for a given month is designed to minimize any changes that

may occur. This method of summarizing data is expected to provide a better overall measure of disease trends and patterns in Georgia.

** Other syphilis includes latent (unknown duration), late latent, late with symptomatic manifestations, and neurosyphilis.

Note: Due to activities to ensure completeness and timeleness of reporting, STD data in this edition of the GER is not current. STD data will be updated and

complete in the next GER.

AIDS Profile Update

Report Period
Latest 12 Months: 01/02-12/02 Five Years Ago: 01/98-12/98 Cumulative: 07/81-12/02

Total Cases Reported* <13yrs >=13yrs Total

2

1,384 1,386

10

1,286 1,296

212

25,589 25,801

Percent Female
24.5
19.6
17.7

Risk Group Distribution (%) MSM IDU MSM&IDU HS Blood Unknown

37.8

7.2

2.0

11.8

2.2

39.1

41.1

18.0

5.7

17.1

0.9

17.3

47.5

17.3

5.4

13.4

1.9

14.5

Race Distribution (%) White Black Other

19.1 75.3

5.6

23.5 74.2

2.3

33.9 63.7

2.5

MSM - Men having sex with men

IDU - Injection drug users

HS - Heterosexual

* Case totals are accumulated by date of report to the Epidemiology Section

- 4 -