{"response":{"docs":[{"id":"dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s8-belec-p-btext","title":"HIPAA fact sheet / Georgia Dept. of Human Resources, Division of Public Health","collection_id":"dlg_ggpd","collection_title":"Georgia Government Publications","dcterms_contributor":["Georgia. Division of Public Health"],"dcterms_spatial":["United States, Georgia, 32.75042, -83.50018"],"dcterms_creator":["Georgia. Department of Human Resources"],"dc_date":["2003-08"],"dcterms_description":["Title from caption"],"dc_format":["application/pdf"],"dcterms_identifier":null,"dcterms_language":["eng"],"dcterms_publisher":["Atlanta, GA : Georgia Dept. of Human Resources, Dept. of Public Health, 2003"],"dc_relation":null,"dc_right":["http://rightsstatements.org/vocab/InC/1.0/"],"dcterms_is_part_of":null,"dcterms_subject":["Public health--Georgia"],"dcterms_title":["HIPAA fact sheet / Georgia Dept. of Human Resources, Division of Public Health","Fact sheet","Public health practice versus research","Disclosures for public health reporting surveillance and investigations"],"dcterms_type":["Text"],"dcterms_provenance":["University of Georgia. Map and Government Information Library"],"edm_is_shown_by":["https://dlg.galileo.usg.edu/do:dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s8-belec-p-btext"],"edm_is_shown_at":["https://dlg.galileo.usg.edu/id:dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s8-belec-p-btext"],"dcterms_temporal":null,"dcterms_rights_holder":null,"dcterms_bibliographic_citation":null,"dlg_local_right":null,"dcterms_medium":["state government records"],"dcterms_extent":null,"dlg_subject_personal":null,"iiif_manifest_url_ss":null,"dcterms_subject_fast":null,"fulltext":"Georgia Department of Human Resources (DHR) Division of Public Health \nHIPAA FACT SHEET: DISCLOSURES FOR PUBLIC HEALTH REPORTING, SURVEILLANCE AND INVESTIGATIONS \nPublic Health Activities Protected by HIPAA \nThe comments to the preamble of the Privacy Rule explicitly protect state public health laws by making it clear that \"nothing in this [Rule] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth or death, public health surveillance, or public health investigation or intervention.\" \nHIPAA Does Not Preempt State Reporting Laws \nThe Privacy Rule specifically states that it does not preempt contrary state public health laws, including state procedures established under such laws, that provide for the reporting of disease or injury, child abuse, birth or death, or for the conduct of public health surveillance, investigation, or intervention. 45 CFR 160.203 (a)(1)(iv)\u0026(c) \nPublic Health Authorities Defined \nPublic health authorities include state public health agencies (e.g., state public health departments or divisions, state cancer registries, and vital statistics departments); local public health agencies; and anyone performing public health functions under a grant of authority from a public health agency. 45 CFR 164.501 \nDisclosures Required by Law \nThe Privacy Rule permits covered entities to disclose protected health information, without authorization, to public health authorities who are authorized by law to receive such reports for the purpose of preventing or controlling disease, injury, or disability and for conducting public health surveillance, investigations, or interventions. This includes federal, tribal, local or state laws (or state procedures established under such law) that provide for receiving reporting of disease, injury or conducting public health surveillance, investigation, or intervention. 45 CFR 164.512 (a)\u0026(b) \nThe Privacy Rule also permits covered entities to disclose protected health information, without authorization, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation. 45 CFR 164.512 (b)(1)(iv) \nPublic Health Authorities are Not Business Associates of Covered Entities \nPublic health authorities receiving information from covered entities as required or authorized by law [See 45 CFR 164.512 (a)\u0026(b)] are not business associates of the covered entities and therefore are not required to enter into business associate agreements. CDC MMWR, Vol. 52, page 8 (May 2003) \nDisclosures Not Required by Law \nFor disclosures not required by law, covered entities may still disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 8-21-03 \n \n Georgia Department of Human Resources (DHR) Division of Public Health \ncontrolling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure. 45 CFR 164.512 (b) \nMinimum Necessary Rule \nGenerally, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. 45 CFR 164.502 (b). However, covered entities are not required to make a minimum necessary determination for disclosures to a health care provider for treatment or for public health disclosures that are required by law. 45 CFR 164.502 (b)(2). For disclosures to a public health authority, covered entities may reasonably rely on a requested disclosure, as the minimum necessary if the public health authority represents that the information requested is the minimum necessary for the stated purpose. 45 CFR 164.514 (d)(3)(iii) \nDisclosures to Foreign Government Agencies \nCovered entities may, at the direction of a public health authority, disclose protected health information to a foreign government agency that is acting in collaboration with a public health authority. 45 CFR 164.512(b)(1)(i) \nAccounting for Public Health Disclosures The Privacy Rule provides for a simplified means of accounting because the vast amount of data exchanged between covered entities and public health authorities is made through ongoing regular reporting. For example, health care providers are required by law to report all cases of notifiable diseases, such as gonorrhea or salmonella, to the local public health authority. In such cases, the covered entity need only identify the recipient of such repetitive disclosures (local public health authority), the purpose of the disclosure (required for communicable disease surveillance), and describe the protected health information routinely disclosed. The date of each disclosure need not be tracked. Rather, the accounting may include the date of the first and last such disclosure during the accounting period (May 1, 2003 to June 1, 2003), and a description of the frequency or periodicity (weekly) of such disclosures. Therefore, the covered entity would not need to annotate each patient's medical record whenever a routine public health disclosure was made. CDC MMWR, Vol. 52, page 9 (May 2003) \nRelevant State Laws: \nO.C.G.A.  31-2-1 (1); Duty, Functions, and Powers of Department O.C.G.A.  31-12-1; Power to Conduct Research and Studies O.C.G.A.  31-12-2; Reporting Disease O.C.G.A.  31-22-7; Reporting by Clinical Laboratories DHR Rules and Regulations, Chapter 290-5-3; Notification of Disease \nSources: \nU.S. Department of Health and Human Services \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 8-21-03 \n \n Georgia Department of Human Resources (DHR) Division of Public Health \nOffice of Civil Rights HIPAA Privacy - Disclosure for Public Health Activities (Revised April 3, 2003) Summary of the HIPAA Privacy Rule (May 2003) \nhttp://www.hhs.gov/ocr/hipaa/privacy.html \nU.S. Department of Health and Human Services Centers for Disease Control and Prevention Morbidity and Mortality Weekly Report Vol. 52 Supplement (May 2, 2003) http://www.cdc.gov/mmwr/preview/ind2003_su.html \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 8-21-03 \n \n "},{"id":"dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s5-belec-p-btext","title":"HIPAA fact sheet / Georgia Dept. of Human Resources, Division of Public Health","collection_id":"dlg_ggpd","collection_title":"Georgia Government Publications","dcterms_contributor":["Georgia. Division of Public Health"],"dcterms_spatial":["United States, Georgia, 32.75042, -83.50018"],"dcterms_creator":["Georgia. Department of Human Resources"],"dc_date":["2003-05"],"dcterms_description":["Title from caption"],"dc_format":["application/pdf"],"dcterms_identifier":null,"dcterms_language":["eng"],"dcterms_publisher":["Atlanta, GA : Georgia Dept. of Human Resources, Dept. of Public Health, 2003"],"dc_relation":null,"dc_right":["http://rightsstatements.org/vocab/InC/1.0/"],"dcterms_is_part_of":null,"dcterms_subject":["Public health--Georgia"],"dcterms_title":["HIPAA fact sheet / Georgia Dept. of Human Resources, Division of Public Health","Fact sheet","Public health practice versus research","Disclosures for public health reporting surveillance and investigations"],"dcterms_type":["Text"],"dcterms_provenance":["University of Georgia. Map and Government Information Library"],"edm_is_shown_by":["https://dlg.galileo.usg.edu/do:dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s5-belec-p-btext"],"edm_is_shown_at":["https://dlg.galileo.usg.edu/id:dlg_ggpd_y-ga-bh800-pp8-bs1-bh46-b2003-s5-belec-p-btext"],"dcterms_temporal":null,"dcterms_rights_holder":null,"dcterms_bibliographic_citation":null,"dlg_local_right":null,"dcterms_medium":["state government records"],"dcterms_extent":null,"dlg_subject_personal":null,"iiif_manifest_url_ss":null,"dcterms_subject_fast":null,"fulltext":"Georgia Department of Human Resources (DHR) Division of Public Health \nHIPAA FACT SHEET: PUBLIC HEALTH PRACTICE VERSUS RESEARCH \nResearch Defined \nResearch is defined in the Privacy Rule as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. [45 CFR 164.501] \nPublic Health Practice \nThe majority of public health activities (e.g., public health surveillance, disease prevention and control projects, and program evaluation) are not designed to contribute to generalizable knowledge even though they are based on scientific evidence and data collection or analytic methods similar to those used in research. Their primary purpose is to protect the health of the population through such activities as disease surveillance, prevention, or control. Public health practice is undertaken with the intent to benefit a specific community, although occasionally they may provide unintended generalizable benefits to others. [CDC MMWR, Vol. 52, page 10 (May 2003)] \nDisclosures for Research Purposes \nA covered entity may always use or disclose health information for research purposes if the information has been de-identified. [45 CFR 164.502 (d)\u0026164.514(a)-(c)] \nPublic Health Practice that Becomes Research \nSome public health activities that are initially public health practice may subsequently evolve into a research activity (e.g., an investigation to determine the cause of an outbreak that incorporates a research study evaluating the efficacy of a new drug to treat the illness). When that is the case, the disclosures may be made initially under the public health provisions of the Privacy Rule. [See 45 CFR 164.512]. But when the activity becomes an ongoing research activity, the entity should consider application of the relevant research disclosures provisions to continue to obtain information for this purpose. [CDC MMWR, Vol. 52, page 10 (May 2003)] \nPublic Health Activities that are Practice and Research \nThere may be cases where the public health activity is both research and public health practice (e.g., an ongoing survey to monitor health conditions in the population, data from which can also be analyzed for research purposes). In those cases, disclosures may be made either under the public health provisions or the research provisions, as appropriate. The Privacy Rule does not require the covered entity to comply with both sets of requirements. Therefore, a public health authority can treat activities that fall under the Privacy Rule exemption for public health activities [See 45 CFR 164.512 (b)] as public health practice and not research. [CDC MMWR, Vol. 52, page 10 (May 2003)] \nResearch Use or Disclosure Without Authorization \nTo use or disclose protected health information without authorization by the research participant, a covered entity must obtain one of the following: \n Documented Institutional Review Board (IRB) or Privacy Board Approval. Documentation that an IRB or a Privacy Board has approved an alteration or waiver of \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 5/03 \n \n Georgia Department of Human Resources (DHR) Division of Public Health \nresearch participants' authorization for use or disclosure of information about them for research purposes. [45 CFR 164.512(i)(1)(i)] \n Preparatory to Research. Representations from the researcher, either in writing or orally, that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purposes preparatory to research, that the researcher will not remove any protected health information from the covered entity, and representation that protected health information for which access is sought is necessary for the research purpose. [45 CFR 164.512(i)(1)(ii)] \n Research on Protected Health Information of Decedents. Representations from the researcher, either in writing or orally, that the use or disclosure being sought is solely for research on the protected health information of decedents, that the protected health information being sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is being sought. [45 CFR 164.512(i)(1)(iii)] \n Limited Data Sets with a Data Use Agreement. A data use agreement entered into by both the covered entity and the researcher, pursuant to which the covered entity may disclose a limited data set to the researcher for research, public health, or health care operations. [45 CFR 164.514(e)]. A limited data set excludes specified direct identifiers of the individual or of relatives, employers, or household members of the individual. \nResearch Use or Disclosure With Authorization \nCovered entities are also permitted to use or disclose protected health information for research purposes when a research participant authorizes the use or disclosure of information about him or herself. In this case, documentation of IRB or Privacy Board approval of a waiver of authorization is not required for the use or disclosure of protected health information. The Privacy Rule has a general set of authorization requirements that apply to all uses and disclosures, including those for research purposes. [45 CFR 164.508]. However, several special provisions apply to research authorizations: \n Unlike other authorizations, an authorization for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues until the \"end of the research study\" [45 CFR 164.508 (c)(1)(v)] \n An authorization for the use or disclosure of protected health information for research may be combined with a consent to participate in the research, or with any other legal permission related to the research study [45 CFR 164.508 (b)(3)(i) \nExemptions from Accounting for Research Disclosures \nGenerally, the Privacy Rule gives individuals the right to receive an accounting of certain disclosures of protected health information made by a covered entity. Among the types of disclosures that are exempt from this accounting requirement are research disclosures made pursuant to an individual's authorization and disclosures of the limited data set to researchers with a data use agreement. [45 CFR 164.528] \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 5/03 \n \n Georgia Department of Human Resources (DHR) Division of Public Health \nAccounting for Research Disclosures \nThe Privacy Rule allows for a simplified accounting of disclosures of protected health information for research purposes made without the individual's authorization pursuant to IRB approval, see 45 CFR 164.512 (i), and that involve at least 50 records. Under this simplified accounting provision, covered entities may provide individuals with a list of all protocols for which the patient's protected health information may have been disclosed under 45 CFR 164.512(i), as well as the researcher's name and contact information. [45 CFR 164.528 (b)(4)] \nRelevant State Laws: \nO.C.G.A.  31-2-1 (1); Duty, Functions, and Powers of Department O.C.G.A.  31-12-1; Power to Conduct Research and Studies \nSources: \nU.S. Department of Health and Human Services Office of Civil Rights HIPAA Privacy  Research (Revised April 3, 2003) \nhttp://www.hhs.gov/ocr/hipaa/privacy.html \nU.S. Department of Health and Human Services Centers for Disease Control and Prevention Morbidity and Mortality Weekly Report Vol. 52 Supplement, May 2, 2003 http://www.cdc.gov/mmwr/preview/ind2003_su.html \n2 Peachtree Street NW  15th Floor  Atlanta, Georgia 30303-3142 404-657-2700  FAX: 404-657-2715 http://health.state.ga.us Rev. 5/03 \n \n "}],"pages":{"current_page":1,"next_page":null,"prev_page":null,"total_pages":1,"limit_value":10,"offset_value":0,"total_count":2,"first_page?":true,"last_page?":true},"facets":[{"name":"type_facet","items":[{"value":"Text","hits":2}],"options":{"sort":"count","limit":16,"offset":0,"prefix":null}},{"name":"creator_facet","items":[{"value":"Georgia. Department of Human Resources","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"subject_facet","items":[{"value":"Public health--Georgia","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"location_facet","items":[{"value":"United States, Georgia, 32.75042, -83.50018","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"year_facet","items":[{"value":"2003","hits":2}],"options":{"sort":"count","limit":100,"offset":0,"prefix":null},"min":"2003","max":"2003","count":2,"missing":0},{"name":"medium_facet","items":[{"value":"state government records","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"fulltext_present_b","items":[{"value":"true","hits":2}],"options":{"sort":"count","limit":100,"offset":0,"prefix":null}},{"name":"rights_facet","items":[{"value":"http://rightsstatements.org/vocab/InC/1.0/","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"collection_titles_sms","items":[{"value":"Georgia Government Publications","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"serial_titles_sms","items":[{"value":"Fact sheet","hits":2},{"value":"HIPAA fact sheet / Georgia Dept. of Human Resources, Division of Public Health.","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"provenance_facet","items":[{"value":"University of Georgia. Map and Government Information Library","hits":2}],"options":{"sort":"count","limit":11,"offset":0,"prefix":null}},{"name":"call_numbers_sms","items":[{"value":"H800.P9 S1 H46/","hits":2},{"value":"H800.P8 S1 H46 2003/5","hits":1},{"value":"H800.P8 S1 H46 2003/8","hits":1}],"options":{"sort":"count","limit":100,"offset":0,"prefix":null}},{"name":"class_name","items":[{"value":"Item","hits":2}],"options":{"sort":"count","limit":100,"offset":0,"prefix":null}},{"name":"geojson","items":[{"value":"{\"type\":\"Feature\",\"geometry\":{\"type\":\"Point\",\"coordinates\":[-83.50018, 32.75042]},\"properties\":{\"placename\":\"United States, Georgia\"}}","hits":2}],"options":{"sort":"index","limit":-2,"offset":0,"prefix":null}},{"name":"placename","items":[{"value":"United States, Georgia","hits":2}],"options":{"sort":"count","limit":100,"offset":0,"prefix":null}}]}}