RE: Informational Privacy and the Public’s Health: The Model State
Public Health Privacy Act (L.O. Gostin, J.G. Hodge, Jr., R.O Valdiserri)
in September, 2001 issue of AJPH.
Gostin, Hodge & Valdiserri’s "The Model State Public Health
Privacy Act" is a much needed step in helping to define how Public Health
will address issues of health information privacy. This issue is the crux
of the HIPAA compliance the health care sector is currently grappling
with. While privacy of health information has always been a concern to
individuals, compromising this privacy has been greatly enhanced by
advances in information technology. This is not fully addressed in this
model.
First, disclosure point #5 regarding "appropriate public or private
agencies performing health oversight function…" needs more clarification.
Of all governmental agencies, Public Health usually do not have the
resources it needs to perform the functions necessary to achieve its
mission. The lack of resources gets worse at the state level, and almost
pitiful at the local level. Public Health has been always extremely
creative through coalition building and community partnerships to provide
the services necessary for ensuring the Public’s health. However, it will
need legal support to justify the need to dedicate intra-agency resources
to manage the growing burden of data in its possession.
Current strategies proposed by the information technology sector and
state governments to warehouse and/or farm out data management to the
private sector for efficient data management and to save money may not be
the most appropriate solutions to handling sensitive health data. I would
like to see:
1. All health data Public Health is responsible for to remain within
the purview and jurisdiction of Public Health agencies;
2. Those at the health data collection level be primarily responsible for:
a. Informing the patients they collect data from that such data will
be shared with public health authorities, should the need arise (i.e.,
health care providers, laboratories, etc.),
b. Ensuring the accuracy of the health data that are submitted to public
health agencies.
Second, while it is reasonable to expect public health practitioners
to ensure the accuracy of the data they collect (i.e., environmental
sampling, community surveys, etc.), it would be a logistical nightmare to
expect public health practitioners to correct errors in the health data
they manage (i.e., mandatory disease reports). This distinction needs to
be made.
Finally, should the sentence in Figure 1, under "Protected Health
Information" read "Any information that relates to an individual’s
physical or mental health status, condition, or, treatment, and which (a)
reveals the identity…." rather than "identify???
Thank you for your time.
Betty C. Jung, RN, MPH