Data Privacy

Laws and Rules

A recent important rule is the Privacy Rule that was issued by the U.S. Department of Health and Human Services (HHS) in 2002 with a compliance date of April 14, 2003, under the mandate of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Privacy Rule provides standards to protect individually identifiable health information. However, the rule only sets conditions for use and disclosure of the data by healthcare plans, healthcare providers, and healthcare clearinghouses. The rule still allows disclosure of an individual's health-related information under certain public health and legal instances.

State law can prevail when it is more stringent than the federal HIPAA Privacy Rule. These state laws vary in the protection they offer and generally pertain to the privacy protection of genetic data. Laws, especially the Privacy Rule, limit the disclosure to the minimum necessary. Minimum necessary restricts disclosure or use to the minimum required to accomplish an individual's healthcare or legal task that enabled the release of the information.

Privacy and the Public's Health

The term data privacy becomes more obscure and indistinguishable from confidentiality as the global demand for information grows each year. As epidemics such as bird flu affect the global population, the terms public health and the common good of the community take on new connotations. Data privacy, or the anonymity of an individual with regard to his or her medical data, is weighed against the common good of the community, such as a city, then a state, and, eventually, a nation. Now our community is the world, and the data privacy of an individual must be weighed against the common good of the global community. Therefore, healthcare providers are required by law to report certain diseases and other health conditions to specific health groups or registries. The data sent to the health groups, such as the state public health department, the Centers for Disease Control and Prevention (CDC), and cancer or other registries, are in one of three forms: [Page 280](1) individually identifiable data, (2) de-identifiable data, or (3) linkable data.

Forms of Data

Individually identifiable data consist of 18 items listed within the HIPAA Privacy Rule as items that can be used to identify an individual. The items are name, zip code with some reservations, dates (birth and death, without year) and the year when the person is 89 years of age or older, and telephone number. The list also includes facsimile number, e-mail address, social security number, medical numbers, and health plan beneficiary numbers. Identifiable data also cover Web universal resource locators (URLs), account numbers, certificate/license numbers, Internet protocol (IP) address, and vehicle identifiers. Also in the list as identifying data are device identifiers and serial numbers; biometric identifiers, full-face photos; and any other unique identifying number, characteristic, or code.

...