Policy Goal 5: Review and improve state policies related to information sharing.
1. Do state health privacy laws restrict cross-sector information sharing to a greater degree than the applicable federal laws?
RATIONALE: Federal laws set a “floor” of privacy protection for health and substance use treatment information, but states may set additional limitations that are more protective of individual privacy. By examining whether state restrictions are preventing information sharing that would otherwise improve care/case management as well as research findings, states can determine whether legislative change in this area would improve outcomes.
Ways to do it
- Assign legislative staff, policy staff from a state agency, or a workgroup within a collaborative body to review state health information privacy laws and make recommendations for any legislative changes needed. Develop examples of how the current law is impeding important data sharing and how the new law would still comply with federal protections for individual privacy.
Things to consider
- States should examine existing provisions that go beyond the protections provided in federal law and identify why these provisions may no longer be necessary or consider how their goals may be accomplished without preventing beneficial information sharing.
- State policymakers should work with local interagency collaboratives to understand places where current state law impedes or prevents beneficial information sharing at the local level, both for care coordination and for data analysis to inform local policymaking.
- The Health Insurance Portability and Accountability Act of 1996 (HIPAA) governs how health entities can disclose individual health information and patient access to information for health entities. HHS has clarified that states may provide additional protections but may not provide fewer protections than are included in HIPAA.
- Protections under 42 CFR Part 2 are intended to protect the privacy of people with substance use disorders. 42 CFR Part 2 is generally stricter than HIPAA, with additional protections and fewer disclosures of information allowed. SAMHSA provides Frequently Asked Questions (FAQs) and Fact Sheets regarding the Substance Abuse Confidentiality Regulations.
Resources
- Does the HIPAA Privacy Rule preempt state laws?, Department of Health and Human Services (HHS)
- Fast Facts for Covered Entities, HHS
2. Do any state policies provide guidance on what information can and can’t be shared, and with whom?
RATIONALE: A common issue underpinning the success of efforts to improve responses to people with behavioral health needs in the criminal justice system is the ability to share data and information across agencies and systems. This is particularly important given the complex needs of this population and that many people have a trajectory that involves contact with multiple systems (health, criminal justice, housing, etc.), and even contact with numerous individual providers or agencies within those systems.
While there can be strong willingness to collaborate and share more information across systems and agencies, misunderstanding of relevant federal and state laws is a significant barrier in and of itself. As such, communities would benefit from a clearer sense of under what circumstances and what types of data/information can be shared across mental health and substance use treatment agencies and providers, law enforcement agencies, jails, courts, community supervision agencies, etc. They could also use guidance and technical assistance to help them identify and address both real and perceived barriers.
Ways to do it
- Issue vetted state-specific guidance on cross-system information sharing, coupled with training and technical assistance.
- Issue a legal opinion clarifying state privacy law through the Attorney General’s Office or a similar legal authority.
Things to consider
- States should develop public-facing guidance on navigating federal and state privacy laws.
- Guidance should include the specific statutes and provide examples of how to comply with the laws for different sets of partners.
- Guidance should be contained in an easy-to-navigate web page.
State Examples
3. Does the state have model forms or other documents that can be used across agencies and providers to share health-related information in a way that is consistent with federal and state privacy laws and protections?
RATIONALE: Model forms and templates that have been recognized by the appropriate state agency as permissible, complete, and correct under state and federal law facilitate the work of counties and alleviate real and perceived barriers to information sharing.
Having a standard or universal release of information (ROI) can reduce confusion associated with each agency/provider having their own forms. In addition, the ability to share information using a form that is consistent with federal and state privacy protections and has been vetted and approved at the state level increases willingness to share information and confidence that agencies and providers are not violating privacy protections in doing so.
Ways to do it
- Issue model forms (i.e., universal consent form or ROI, MOU template, data use agreement template, business associate agreement [BAA] template) and policies or instructions for use.
- Pass legislation calling for the creation and use of forms and by whom, including that such forms must be used by specified agencies and must be accepted.
Things to consider
- Consent forms and authorization forms must comply with applicable state and federal law.
- Standardized forms developed by the state do not have to be utilized by every covered entity, but covered entities should be required to accept the state’s standardized forms. This means that consent forms should be universally offered, and agencies should be required to accept completed forms, as well as share information that is authorized through these completed forms.
State Examples
4. Has the state issued a directive to facilitate appropriate information sharing among criminal justice and health partners, as well as other sectors such as housing?
RATIONALE: Recognizing that local stakeholders may be hesitant to share information across systems, states can proactively define permitted information exchanges to eliminate doubt, clearly delineate permitted carveouts that would otherwise be prevented under state law, and provide guidance on privacy protection measures.
Clear guidance from a state authority and/or amending state law to include permissive language eliminates the guesswork for local partners and reduces fear about HIPAA violations that can prevent initiatives from getting off the ground in the first place.
Ways to do it
- Issue vetted guidance on cross-system information sharing from a legal authority, such as a state Attorney General’s Office.
- Issue an executive order to better facilitate cross-system information sharing.
- Pass legislation with permissive language delineating permitted carveouts for cross-system information sharing.