February 2004 volume 20 number 2 Division of Public Health http://health.state.ga.us Kathleen E. Toomey, M.D., M.P.H. Director State Health Officer Epidemiology Branch http://health.state.ga.us/epi Paul A. Blake, M.D., M.P.H. Director State Epidemiologist Mel Ralston Public Health Advisor Georgia Epidemiology Report Editorial Board Carol A. Hoban, M.S., M.P.H. - Editor Kathryn E. Arnold, M.D. Paul A. Blake, M.D., M.P.H. Susan Lance-Parker, D.V.M., Ph.D. Kathleen E. Toomey, M.D., M.P.H. Angela Alexander - Mailing List Jimmy Clanton, Jr. - Graphic Designer Georgia Department of Human Resources Division of Public Health Epidemiology Branch Two Peachtree St., N.W. Atlanta, GA 30303-3186 Phone: (404) 657-2588 Fax: (404) 657-7517 Please send comments to: Gaepinfo@dhr.state.ga.us The Georgia Epidemiology Report is a publication of the Epidemiology Branch, Division of Public Health, Georgia Department of Human Resources How Does HIPAA Affect Disease Reporting To Public Health? The Health Insurance Portability and Accountability Act (HIPAA), enacted by Congress in 1996, covers not only health insurance portability but also the privacy and security of health information. Congress gave the U.S. Department of Health and Human Services (DHHS) authority to adopt rules to implement HIPAA. What are the implications of HIPAA rules for disease reporting? 1. HIPAA was not intended to affect public health reporting. The comments in the preamble to the HIPAA Privacy Rule explicitly protect state public health laws: "...nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention." 2. HIPAA covered entities (health care providers, health plans, health care clearinghouses) must comply with HIPAA privacy rules as of April 14, 2003. The HIPAA privacy rules are found at 45 Code of Federal Regulations (CFR), sections 160 and 164. Although the HIPAA privacy rules generally preempt state law, they make exceptions. One exception is when state law or rules provide "for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention." (45 CFR 160.203 (c)). This is consistent with the Congressional directive that HIPAA not affect public health reporting. 3. In general, HIPAA privacy rules require covered entities to get patient authorization before disclosing health information (45 CFR 164.508). However, the HIPAA privacy rules provide that for certain disclosures, no authorization is required. Among them: Required by law. Under 45 CFR 164.512 (a)(1), "a covered entity may use ... protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law." Note that per the definition section of 45 CFR 164.501, "required by law means a mandate contained in law that compels an entity to make a ... disclosure of protected health information and that...includes...statutes or regulations that require the production of information..." The Georgia Epidemiology Report Via E-Mail To better serve our readers, we would like to know if you would prefer to receive the GER by e-mail as a readable PDF file starting in 2004. If yes, please send your name and e-mail address to Gaepinfo@dhr.state.ga.us. For public health activities. Under 45 CFR 164.512 (b)(1)(i), "Permitted disclosures. A covered entity may disclose protected health information...to...a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions." 4. The HIPAA privacy rules have a minimum necessary standard in 45 CFR 164.502 (b) that states: "When...disclosing protected health information..., a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." Note, however, under 45 CFR 164.502 (b)(2)(v), that "this requirement does not apply to...uses or disclosures that are required by law, as described by section 164.512(a)...." Further, for public health reporting authorized by law, a covered entity may rely on the Division of Public Health's request to be the minimum necessary, per 45 CFR 164.514(d)(3)(iii)(A), which says that "a covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when...making disclosures to public officials that are permitted under Section 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s) ...." 5. There are a number of provisions in the Georgia Statutes and Rules that require or authorize public health reporting by covered entities. These public health reporting provisions are not affected by the HIPAA privacy rules. Some of these include: O.C.G.A. 31-12-1. Power to conduct research and studies. The Department of Human Resources and county boards of health are empowered to conduct studies, research, and training appropriate to the prevention of diseases and accidents, the use and control of toxic materials, and the prevention of environmental conditions which, if permitted to develop or continue, would likely endanger the health of individuals or communities. O.C.G.A. 31-12-2. Reporting disease; confidentiality. The department is empowered to declare certain diseases, injuries, and conditions to be diseases requiring notice and to require the reporting thereof..... All such reports and data shall be deemed confidential and shall not be open to inspection by the public; provided, however, the department may release such reports and data in statistical form or for valid research purposes. O.C.G.A. 31-22-7. Reports to department. The department shall require reporting by clinical laboratories of evidence of such infectious diseases as the department may specify.... No clinical laboratory making reports shall be held liable for having violated a trust or confidential relationship. The reports submitted shall be deemed confidential and not subject to public inspection. Rule 290-5-3-.04 Liability. Any person, including but not limited to practitioners of the healing arts, submitting in good-faith reports or data to the Department or county boards of health in compliance with the provisions of this Rule shall not be liable for any civil damages therefor. So, in summary, HIPAA privacy rules allow doctors, hospitals, HMOs, health insurers, and other covered entities to report public health information to the Division of Public Health as in the past, without patient authorization. 45 CFR 164.512 (a)&(b) allows covered entities to continue to report communicable disease information without patient authorization as required by Georgia Statutes and Rules. These provisions of the HIPAA privacy rules allow other public health reporting as well. For a link to an unofficial compiled version of the HIPAA privacy rules that incorporates the rules as adopted, along with the amendments, go to: http://www.hhs.gov/ocr/hipaa/ finalreg.html. Additional helpful guidance on HIPAA privacy rule's has recently been released, with a section devoted to public health issues that discusses reporting under HIPAA. Go to: http://www.hhs.gov/ocr/hipaa/privacy.html and click on "public health". This information has been adapted in part from "HIPAA and Disease Reporting", an article by Dave Orren, Data Practices Coordinator and HIPAA Privacy Official, in the Minnesota Department of Health publication Bug Bytes (November 19, 2002, Vol. 3: No. 14). -2 - HIV Reporting in Georgia Notifiable Disease Reporting Since the early 1980s, Georgia's Division of Public Health (DPH) has collected epidemiologic information on individuals with AIDS. Those working in HIV prevention and care have found these data invaluable for program planning, setting target populations to be, tracking the epidemic, lobbying legislators, and acquiring funding. But, the field of HIV is constantly changing and challenging us. New therapies have improved the health and lives of many living with HIV and reduced the usefulness of AIDS data. Given the success of HIV care today, many infected with HIV may never be diagnosed with AIDS. Data collected on those with AIDS do not adequately reflect the HIV epidemic. In response to these changes, DPH is implementing HIV Infection Reporting. Georgia is the final state in the country to begin comprehensive HIV/AIDS reporting, and has been engaged in a 12month process to add HIV reporting to our current AIDS reporting. A plan to collect data has been developed by DPH and reviewed by the public. On December 31, 2003, DPH began HIV reporting. HIV reporting will allow us to more accurately understand the epidemic in Georgia. Georgia will be able to provide accurate numbers of people infected with HIV and the number living with HIV, and will be able to participate in a new Centers for Disease Control and Prevention (CDC) HIV Incidence Project to estimate the number of new infections occurring each year. Additionally, public health can begin to recruit HIV positive, non-AIDS volunteers for the Supplement to HIV/AIDS Surveillance (SHAS) behavioral interview project. These data will help planning groups better target resources to the most at-risk populations and increase Georgia's ability to receive our share of prevention and care dollars. Maintaining the security and confidentiality of HIV/AIDS data is a priority for DPH and an important concern for those infected with HIV. HIV/AIDS data never leave our office with identifiers. Identifiable information is not shared with insurance companies, landlords, or other government agencies. The HIV/AIDS Epidemiology office follows strict security and confidentiality guidelines established by the CDC. As we prepare to begin HIV reporting, we are making efforts to further tighten security and further reduce the chance of a breach of confidentiality. Please visit our website where you can find reports on HIV/ AIDS in Georgia and several documents regarding HIV reporting. Our web address is http://www.ph.dhr.state.ga.us/ epi/aidsunit.shtml. The Georgia Department of Human Resources, under the legal authority of O.C.G.A. 31-12-2 and with the approval of the Board of Human Resources, has designated certain diseases and conditions notifiable. The purpose of the reportable disease surveillance is to: 1. Identify in a timely way any diseases or conditions that may require immediate public health intervention and follow up; 2. Detect changing trends or patterns in disease occurrence; 3. Identify areas or communities that require special public health response as a result of changes in disease patterns; and 4. Assess and evaluate control and prevention interventions. In Georgia, public health surveillance is conducted on more than 50 diseases and conditions. The data are collected by local and state health agencies who are responsible for analyzing, interpreting and disseminating the information to "those who need to know" for administrative, program planning, and decision making purposes. Purpose of Report The purpose of Notifiable disease Reporting is to document information on reportable diseases in Georgia for health care providers, public health workers, and policy makers. The information is vital to determine the disease burden in Georgia, who is affected, and the public health actions needed to control and prevent disease. Source of Data The diseases are reported by county health departments, health district offices, hospitals, clinical and state laboratories, physicians and public and private clinics to the Epidemiology Branch in the Division of Public Health. Cases are reported electronically through the State Electronic Notifiable Disease Surveillance System (SENDSS) at http://sendss.state.ga.us, or by completing a Notifiable Disease Reporting Form (#3095) and mailing in an envelope marked CONFIDENTIAL, or by calling your County Health Department or District Health Office, or the Notifiable Disease Section at 404-657-2588. Population data used to calculate rates were based on estimates generated by the U.S. Census Bureau. -3 - The Georgia Epidemiology Report Epidemiology Branch Two Peachtree St., NW Atlanta, GA 30303-3186 PRESORTED STANDARD U.S. POSTAGE PAID ATLANTA, GA PERMIT NO. 4528 February 2004 Volume 20 Number 2 Reported Cases of Selected Notifiable Diseases in Georgia Profile* for November 2003 Selected Notifiable Diseases Campylobacteriosis Chlamydia trachomatis Cryptosporidiosis E. coli O157:H7 Giardiasis Gonorrhea Haemophilus influenzae (invasive) Hepatitis A (acute) Hepatitis B (acute) Legionellosis Lyme Disease Meningococcal Disease (invasive) Mumps Pertussis Rubella Salmonellosis Shigellosis Syphilis - Primary Syphilis - Secondary Syphilis - Early Latent Syphilis - Other** Syphilis - Congenital Tuberculosis Total Reported for November 2003 2003 25 195 12 1 57 190 1 42 41 0 0 2 0 0 0 162 44 2 10 19 13 0 37 Previous 3 Months Total Ending in November 2001 2002 2003 119 177 107 8278 9014 3457 51 34 34 21 6 4 255 244 237 4715 4894 1914 25 22 9 234 117 363 131 112 176 2 9 5 0 1 1 16 7 5 1 0 1 6 5 2 0 0 0 561 681 722 354 772 213 16 25 18 73 100 53 178 205 83 212 196 81 6 1 0 148 131 114 Previous 12 Months Total Ending in November 2001 2002 2003 634 657 629 32877 34552 30224 161 127 119 47 45 29 1005 898 862 18324 18946 15256 108 97 61 929 509 796 441 464 670 11 20 30 1 5 13 56 34 29 9 2 3 26 27 20 0 0 0 1699 1968 2013 597 1818 1314 94 110 106 304 329 368 637 745 635 866 776 661 25 14 10 579 603 492 * The cumulative numbers in the above table reflect the date the disease was first diagnosed rather than the date the report was received at the state office, and therefore are subject to change over time due to late reporting. The 3 month delay in the disease profile for a given month is designed to minimize any changes that may occur. This method of summarizing data is expected to provide a better overall measure of disease trends and patterns in Georgia. ** Other syphilis includes latent (unknown duration), late latent, late with symptomatic manifestations, and neurosyphilis. Note: Due to activities to ensure completeness and timeleness of reporting, STD data in this edition of the GER is not current. STD data will be updated and complete in the next GER. AIDS Profile Update Report Period Latest 12 Months: 01/02-12/02 Five Years Ago: 01/98-12/98 Cumulative: 07/81-12/02 Total Cases Reported* <13yrs >=13yrs Total 2 1,384 1,386 10 1,286 1,296 212 25,589 25,801 Percent Female 24.5 19.6 17.7 Risk Group Distribution (%) MSM IDU MSM&IDU HS Blood Unknown 37.8 7.2 2.0 11.8 2.2 39.1 41.1 18.0 5.7 17.1 0.9 17.3 47.5 17.3 5.4 13.4 1.9 14.5 Race Distribution (%) White Black Other 19.1 75.3 5.6 23.5 74.2 2.3 33.9 63.7 2.5 MSM - Men having sex with men IDU - Injection drug users HS - Heterosexual * Case totals are accumulated by date of report to the Epidemiology Section - 4 -