Incorporating HIPAA Privacy Rule into Medical Record Surveys

• Activity Number: 403
• Type: Topic Contributed
• Date/Time: Thursday, August 12, 2004 : 8:30 AM to 10:20 AM
• Sponsor: Section on Government Statistics
• Author(s): Catharine W. Burt*+
• Companies: Centers for Disease Control and Prevention

Abstract

Provider-based surveys that collect information from medical records were challenged by new requirements in the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) which became effective April 14, 2003. While CDC surveys are authorized under the Public Health Service Act, which assures confidentiality provided by law, the new regulation sets further standards for providers when disclosing protected health information for research or public health purposes. This paper describes the ways survey procedures were modified to assist providers in participating in the surveys under the new guidelines including obtaining or modifying IRB approval, creating data use agreements, completing accounting documents for disclosures made to assist the proivders' record keeping requirements, creating new training materials for field staff and new web page materials for providers, etc. Implementation of HIPAA's Privacy Rule led to increased survey costs but had less of an effect on survey response than was anticipated. In some respects, the additional assurances of confidentiality made some providers more comfortable with providing patient data. However, the full impact on response rates will need to be measured over time as providers and survey organizations become more confident about the provisions in the Privacy Rule allowing continued survey participation.