From David.Solet@METROKC.GOV Sun Jul 9 14:38:02 2000 Received: from mxu2.u.washington.edu (mxu2.u.washington.edu [140.142.32.9]) by lists.u.washington.edu (8.9.3+UW00.05/8.9.3+UW99.09) with ESMTP id OAA158192 for ; Sun, 9 Jul 2000 14:38:02 -0700 Received: from kcims.metrokc.gov (kcims.metrokc.gov [146.129.177.168]) by mxu2.u.washington.edu (8.9.3+UW00.02/8.9.3+UW99.09) with ESMTP id OAA07215 for ; Sun, 9 Jul 2000 14:38:01 -0700 Received: by kcims.metrokc.gov with Internet Mail Service (5.5.2650.21) id ; Sun, 9 Jul 2000 14:37:27 -0700 Message-ID: From: "Solet, David" To: "'ph-assess@u.washington.edu'" Subject: RE: HIPPA Date: Sun, 9 Jul 2000 14:35:39 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01BFE9ED.E0311FE0" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01BFE9ED.E0311FE0 Content-Type: text/plain; charset="iso-8859-1" Thanks, Vicki. From your answer, I gather there are still questions about if and how HIPPA will affect assessment activities. Do you think a session at the state health conference, or a presentation at the recently revived regional assessment meetings could help the rest of us understand the issues? --David David Solet, PhD Assistant Chief, Epidemiology, Planning and Evaluation Unit Public Health, Seattle and King County 999 Third Avenue, Suite 1200 Seattle, WA 98104 Phone: (206) 296-2782 Fax: (206) 205-5314 e-mail: david.solet@metrokc.gov -----Original Message----- From: Hohner, Vicki [mailto:Vicki.Hohner@DOH.WA.GOV] Sent: Friday, July 07, 2000 6:08 PM To: Washington public health assessment coordinators Subject: RE: HIPPA Mike, I've been involved in looking at the HIPAA regs for DOH for the last 2 1/2 years. Part of HIPAA involves standardizing electronic health service transactions, and setting privacy and security standards for health information. It will actually result in 8 or 9 regulations all told to accomplish this. I am sending along a Powerpoint presentation I recently gave to both WSALPHO and PHELF as a general overview of that portion of HIPAA, known as administrative simplification. We are expecting to see the first final regulation, related to electronic transaction standards, any day now. I think the particular regulation that you are raising concerns over is the privacy regulation. These are the longest (600+ pages) and most controversial regulations in the mix, and would not even have been part of the regulations if Congress had passed national legislation around health information privacy. While some concerns have been raised, it is also true that the privacy regulations are limited in what they cover. There are some exemptions built in for public health uses, as the intent was not to impact public health activities or uses of data. In our quick internal DOH review we felt that in general we already follow similar policies in the agency. We did not see any particular conflicts with GIS, although it may make us more vigilant over what we release or make available via the web in GIS format. This is not necessarily bad, as there have been privacy issues with information in GIS format all along which have never been satisfactorily resolved. We don't know how these regulations may impact you at the local level, because I don't think anyone in DOH is familiar with what the local policies are on this topic, and I imagine that the various jurisdictions could have different approaches as well. There may be issues related to the fact that most local health jurisdictions provide health services, and providers are clearly covered under the regulations. However, one of the clarifications that has to be made in the rules is where to draw the boundaries, and whether, if part of an organization meets the criteria of a "covered entity", it necessarily means that the entire organization must comply. These are all issues that we will not be able to resolve until we see the final regulations. The last "rumor" I heard is that they were expecting the privacy regulations to be finalized in September. We are aware that whatever happens with the privacy regs, they are intended to supercede any weaker privacy laws at the state level. However, I imagine it will take quite some time to go through the legal analyses and processes necessary to review our laws, and then there is a requirement to pass laws that we judge would remain on the books by DHHS for review and confirmation (although at present this process is very vaguely described). It will be a long process before all the issues are sorted out and understood, and at any time Congress could pass a health information privacy law that would effectively override the regulation. It is a big topic where there are still a lot of unknowns, so I'm sorry I can't provide more definitive answers at this time. If you need more information on this, why don't you contact me directly? I have also sent in an abstract for a presentation on this topic for the upcoming Joint Conference. It will help me to know your issues ahead of time, as it will help me put together a presentation that will focus on your areas of interest and concern. ***This message may be confidential. If you received it by mistake, please notify the sender and delete the message. All messages to and from the Department of Health may be disclosed to the public.*** Vicki Hohner Hospital and Patient Data Center for Health Statistics Department of Health P.O. Box 47811 1102 SE Quince St. Olympia, WA 98504-7811 Ph: (360)236-4211 Fax: (360)664-8579 email: vicki.hohner@doh.wa.gov ------_=_NextPart_001_01BFE9ED.E0311FE0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: HIPPA

Thanks, Vicki.  From your answer, I gather there = are still questions about if and how HIPPA will affect assessment = activities.  Do you think a session at the state health = conference, or a presentation at the recently revived regional = assessment meetings could help the rest of us understand the = issues?

--David

David Solet, PhD
Assistant Chief, Epidemiology, Planning and = Evaluation Unit
Public Health, Seattle and King County
999 Third Avenue, Suite 1200
Seattle, WA  98104

Phone:  (206) 296-2782
Fax: (206) 205-5314
e-mail:  david.solet@metrokc.gov

-----Original Message-----
From: Hohner, Vicki [mailto:Vicki.Hohner@DOH.WA.GOV]
Sent: Friday, July 07, 2000 6:08 PM
To: Washington public health assessment = coordinators
Subject: RE: HIPPA


Mike, I've been involved in looking at the HIPAA regs = for DOH for the last 2
1/2 years. Part of HIPAA involves standardizing = electronic health service
transactions, and setting privacy and security = standards for health
information. It will actually result in 8 or 9 = regulations all told to
accomplish this. I am sending along a Powerpoint = presentation I recently
gave to both WSALPHO and PHELF as a general overview = of that portion of
HIPAA, known as administrative simplification. =

We are expecting to see the first final regulation, = related to electronic
transaction standards, any day now. I think the = particular regulation that
you are raising concerns over is the privacy = regulation. These are the
longest (600+ pages) and most controversial = regulations in the mix, and
would not even have been part of the regulations if = Congress had passed
national legislation around health information = privacy. While some concerns
have been raised, it is also true that the privacy = regulations are limited
in what they cover. There are some exemptions built = in for public health
uses, as the intent was not to impact public health = activities or uses of
data. In our quick internal DOH review we felt that = in general we already
follow similar policies in the agency. We did not = see any particular
conflicts with GIS, although it may make us more = vigilant over what we
release or make available via the web in GIS format. = This is not necessarily
bad, as there have been privacy issues with = information in GIS format all
along which have never been satisfactorily resolved. =

We don't know how these regulations may impact you at = the local level,
because I don't think anyone in DOH is familiar with = what the local policies
are on this topic, and I imagine that the various = jurisdictions could have
different approaches as well. There may be issues = related to the fact that
most local health jurisdictions provide health = services, and providers are
clearly covered under the regulations. However, one = of the clarifications
that has to be made in the rules is where to draw = the boundaries, and
whether, if part of an organization meets the = criteria of a "covered
entity",  it necessarily means that the = entire organization must comply.
These are all issues that we will not be able to = resolve until we see the
final regulations. The last "rumor" I = heard is that they were expecting the
privacy regulations to be finalized in September. =

We are aware that whatever happens with the privacy = regs, they are intended
to supercede any weaker privacy laws at the state = level. However, I imagine
it will take quite some time to go through the legal = analyses and processes
necessary to review our laws, and then there is a = requirement to pass laws
that we judge would remain on the books by DHHS for = review and confirmation
(although at present this process is very vaguely = described). It will be a
long process before all the issues are sorted out = and understood, and at any
time Congress could pass a health information = privacy law that would
effectively override the regulation. It is a big = topic where there are still
a lot of unknowns, so I'm sorry I can't provide more = definitive answers at
this time.

If you need more information on this, why don't you = contact me directly? I
have also sent in an abstract for a presentation on = this topic for the
upcoming Joint Conference. It will help me to know = your issues ahead of
time, as it will help me put together a presentation = that will focus on your
areas of interest and concern.    =

***This message may be confidential. If you received = it by mistake, please
notify the sender and delete the message. All = messages to and from the
Department of Health may be disclosed to the = public.***

Vicki Hohner
Hospital and Patient Data
Center for Health Statistics
Department of Health
P.O. Box 47811
1102 SE Quince St.
Olympia, WA  98504-7811
Ph:  (360)236-4211
Fax: (360)664-8579
email: vicki.hohner@doh.wa.gov


------_=_NextPart_001_01BFE9ED.E0311FE0-- .