Ala. Admin. Code r. 420-12-1-.08

Current through Register Vol. 43, No. 02, November 27, 2024

Section 420-12-1-.08 - Confidential Information

(1) All information reported to the Department pursuant to Code of Ala. 1975, § 22-21-410, et seq., and this Chapter is not available for release until it has been processed and verified by the Department.

(2) Discharge Data that has been processed and verified may be released by the Department pursuant to the provisions of 45 C.F.R. §§ 164.514(b) or (e), as applicable, provided, also, that such data satisfies the requirements for public disclosure under Code of Ala. 1975, § 22-21-410, et seq., this Chapter, and any other applicable federal law.

(3) In no event may patient identifiers be released to the public at any time. The Department shall not publicly release Discharge Data or other information in any form which could reasonably be expected to reveal the identity of any patient. Reports and studies prepared and released by the Department based upon Discharge Data shall not include any specific information or combination of information which could be used to identify any patient.

(a) To maintain patient confidentiality, data files and/or reports released to the public must, at a minimum, meet the following criteria:

1. Patient name, address, and city must be deleted.

2. The month and day of all dates must be deleted.

3. All zip code areas having a population under 20,000 must have no more than the first three digits shown. Zip code areas having a population of 20,000 or more must have no more than the first five digits shown.

4. For patients over 89 years of age, the year of birth must be deleted, and the actual patient age may not be shown.

5. Information that reasonably could be expected to reveal the identity of a patient, including those items contained in 45 C.F.R. § 164.514(b)(2)(i), must be deleted. Limited data sets must exclude the direct identifiers of the individual patient or of relatives, employers, or household members of the individual patient enumerated in 45 C.F.R. § 164.514(e)(2).

(4) The Department may conduct studies and publish information based upon the de-identified, zip-code aggregated level Discharge Data, provided the studies and published information do not include information in a form which could be used to identify any patient or violate HIPAA.

(5) Individual patient data submitted to the Department by a hospital shall not constitute a public record and shall at all times remain confidential and privileged from discovery. The release of identifiable patient health information may be made only to the hospital that initially reported the identifiable information, upon the written request of the hospital.

(6) Any agency of the State of Alabama receiving confidential hospital Discharge Data or Discharge Data Reports containing such confidential information shall agree in writing to follow all confidentiality restrictions of the Department concerning use of such data.

(7) Discovery of patient specific information from original sources is not precluded where the information is otherwise non privileged and discoverable under applicable law.

(8) The State Health Officer may use or authorize use of this data for purposes that are necessary to provide for or protect the health of the population and as permitted by law.

Ala. Admin. Code r. 420-12-1-.08

Adopted by Alabama Administrative Monthly Volume XL, Issue No. 04, January 31, 2022, eff. 3/17/2022.

Author: Sherri L. Davidson, Ph.D., M.P.H.; Dana H. Billingsley

Statutory Authority:Code of Ala. 1975, § 22-21-410, et seq.