102 Delaware Health Information Network Regulations on Use of Clinical Data for Approved Analytic Purposes

Delaware General Assembly : Delaware Regulations : Administrative Code : Title 1 : 100

Authenticated PDF Version

100 Delaware Health Information Network

102 Delaware Health Information Network Regulations on Use of Clinical Data for Approved Analytic Purposes

1.0 Scope and Authority

1.1 A significant part of the statutory mandate of the Delaware Health Information Network ("DHIN") is to support and improve the efforts of health care providers, payers, researchers, and state instrumentalities in improving the quality and lowering the costs of health care in the State of Delaware. As a part of that mandate, the General Assembly has authorized DHIN, where permitted by its agreements with its Data Sending Organizations, to permit appropriate individuals and organizations to access clinical data in its possession for approved research purposes. Such access must be limited and comply with the terms and conditions established by DHIN to protect the safety and confidentiality of patient information. Nothing in this regulation is intended to alter the ability of Data Receiving Organizations (as that term is defined in 1 DE Admin. Code 101) to use clinical data received from DHIN consistent with existing data use and business associate agreements each has entered into with DHIN.

1.2 DHIN has been authorized by statute, 16 Del.C. §§10306 & 10307, to promulgate rules and regulations to carry out its statutory mandate.

2.0 Definitions

The following words and terms, when used in this regulation, have the following meaning unless the context clearly indicates otherwise:

"Act" means DHIN's enabling legislation, 16 Del.C. Chapter 103.

"Approved User" means any person or organization that DHIN has authorized to view or access Available Clinical Data.

"Available Clinical Data" means Data included in DHIN's Clinical Data Repositories as to which DHIN has appropriate agreements in place with the Data Sending Organization that provided the Data to DHIN to permit use of that Data for the analytic purposes identified in this regulation.

"Board" means DHIN's Board of Directors, as established by the Act.

"Bylaws" means the Bylaws as approved by the Board.

"Clinical Data Access Committee" or "Committee" means the subcommittee established by the Board and governed by its Bylaws that has the authority to determine when applications for Available Clinical Data should be provided to a data requestor to facilitate the purposes of the Act, and such other duties as designated by the Board consistent with the Act. If the Board so determines, the Committee can (but need not) be the same committee that determines access to claims data held within the Delaware Health Care Claims Database, as set forth in 1 DE Admin. Code 104.

"Data" means medical or other health care information of or about an individual which is transmitted or available from Data Sending Organizations for transmission to DHIN and included in DHIN's clinical data repositories. The term includes PHI.

"Data Sending Organization" means an organization that contracts with DHIN to provide Data to DHIN for use in its clinical data repositories for purposes consistent with the Act, these regulations, and the contract between DHIN and Data Sending Organization. The term does not include organizations that solely provide claims data to the Health Care Claims Database pursuant to 1 DE Admin. Code 104, or organizations that solely contract with DHIN to receive analytic services or clinical data for approved analytic use cases pursuant to 1 DE Admin. Code 102.

"De-identified data" means de-identified data as defined in HIPAA. Unless otherwise defined in HIPAA, it shall mean health information that is not considered PHI because it excludes the following direct and indirect patient identifiers:

•	Direct Patient Identifiers

•

Names;

•	Telephone numbers;

•	Fax numbers;

•	Email addresses;

•	Social security numbers;

•	Medical record numbers;

•	Health plan beneficiary numbers;

•	Account numbers;

•	Certificate/license numbers;

•	Vehicle identifiers and serial numbers;

•	Device identifiers and serial numbers;

•

URL's;

•	IP addresses;

•	Biometric identifiers, including fingerprints;

•	Full-face photographs;

•	Any other unique identifying characteristic or code.

•	Indirect Patient Identifiers

•	All geographic subdivisions smaller than a state, except for the initial three digits of a zip code;

•

All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 as amended and associated regulations, including the Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164) and Security Rule (45 CFR Part 160 and Subparts A and C of Part 164).

"Identified data" means health information as defined in HIPAA that contains direct patient identifiers.

"Limited data set" means a limited data set as defined in HIPAA. Unless otherwise set forth in HIPAA, the term means PHI that excludes 16 categories of direct identifiers and may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual's authorization or a waiver or an alteration of authorization for its use and disclosure, with a data use agreement. The following data elements are removed from a limited data set:

•

Names;

•	Postal address information, other than town or city, state, and ZIP Code;

•	Telephone number;

•	Fax numbers;

•	Electronic mail addresses;

•	Social Security numbers;

•	Medical record numbers;

•	Health plan beneficiary numbers;

•	Account numbers;

•	Certificate/license numbers;

•	Vehicle identifiers and serial numbers, including license plate numbers;

•	Device identifiers and serial numbers;

•	Web universal resource locators (URLs);

•	Internet protocol (IP) address numbers;

•	Biometric identifiers, including fingerprints and voiceprints;

•	Full-face photographic images and any comparable images.

A limited data set may include

•	City, state, ZIP Code;

•	Elements of dates;

•	Other numbers, characteristics, or codes not listed as direct identifiers.

"Protected health information" or "PHI" means individually identifiable health information, as that term is defined in HIPAA.

"Provider" means a hospital, facility, or any health care practitioner licensed, certified, or authorized under State law to provide health care services and includes hospitals and health care practitioners participating in group arrangements, including accountable care organizations, in which the hospital or health care practitioners agree to assume responsibility for the quality and cost of health care for a designated group of beneficiaries.

"Re-disclosure" means the publication, distribution or other dissemination of Available Clinical Data released to an Approved User using any medium and in any format, context or structure.

3.0 General Data Access Provisions

3.1 Available Clinical Data may be released to a person or organization for purposes of:

3.1.1 Facilitating data-driven, evidence-based improvements in access to and quality of health care;

3.1.2 Improving the health of Delawareans generally;

3.1.3 Lowering the growth in per-capita health care costs; or

3.1.4 Providing enhanced provider experience that promotes patient engagement.

3.2 Unless otherwise provided for in this regulation, requests for access to Available Clinical Data or for analytic services based thereupon shall require completion of a written Data access application, in a form to be published by DHIN on its website, that describes the intended purpose and use of the data, the justification for the data request, and the security and privacy measures that will be used to safeguard the data and prevent unauthorized access to or use of the data. DHIN may require such additional information from a data requestor as DHIN determines, in its discretion, is required to evaluate any particular request. Exceptions to this rule include:

3.2.1 Requests by a Data Sending Organization for access to its own data or for analytic services based upon its own data shall not require Committee review or approval.

3.2.2 The Committee, at a duly noticed public meeting, may authorize additional exceptions to this rule, provided such exceptions are consistent with the requirements of the Act, HIPAA, and relevant Delaware law. Any such exceptions shall be identified publicly on DHIN's website.

3.3 If authorized by the Committee or the Board, de-identified data or the analytic evaluation thereof may be released to applying parties or the public without obtaining full Board or Committee review.

3.3.1 Release of such de-identified data shall be pursuant to such terms and conditions as are established by the Committee or the Board.

3.3.2 Release of such de-identified data shall only be permitted if the purposes for such release are consistent with the purposes for release of data set forth in the Act and this regulation.