Confirm Policy Path
eCR Data Sharing Policy Overview
Every state and territory in the United States has laws that require and enable the reporting of certain conditions to the appropriate state and/or local public health agency (PHA). Laws differ on whether reporting needs to be done from healthcare organizations (HCOs) to the state or local PHAs, or both. If a patient resides out of the state where care was provided, often the state of the patient’s residence will also require reporting.
The federal Health Information Portability and Accountability Act (HIPAA), in combination with state laws, enables this reporting to public health authorities without patient consent, special authorizations, or data use agreements for the purpose of preventing or controlling disease, injury, or disability (Learn more on the US Department of Health & Human Services Health Information Privacy site (external link)).
The Health Level Seven International (HL7) Electronic Initial Case Report (eICR) standard was developed based on the work of a Council of State and Territorial Epidemiologists (CSTE) task force, which identified the data needed for an all-condition, all-jurisdiction initial case report.
Because reportable conditions are stipulated in state and local laws, PHAs are also careful to receive data for only the reportable conditions that are so referenced. Given these complex rules for reporting, it is difficult for HCOs and electronic health record (EHR) companies to easily comply without support. With electronic case reporting (eCR), the Association of Public Health Laboratories (APHL) Informatics Messaging Services (AIMS) platform and the CSTE Reportable Conditions Knowledge Management System (RCKMS) provide HCOs with a single connection where these reporting complexities are managed for them.
To help HCOs report, APHL needs to receive eICRs under HIPAA business associate or comparable authorities so that it can confirm conditions are indeed reportable in a given state or territory, before sending them on to the appropriate jurisdictions. In this way, the APHL is supporting HIPAA treatment, payment, and operations needed for public health reporting, and making a public health disclosure to the appropriate PHAs.
eICRs are securely received and processed on behalf of the HCOs from which they originate. Using rules authored by each state and local PHAs, the eICRs are transmitted to appropriate PHAs. The eICRs are only maintained by the APHL AIMS platform long enough to complete routing to the appropriate PHAs and address any errors in that delivery. Beyond that, no eICRs are retained by APHL AIMS. Additionally, eICRs are not directly sent to the Centers for Disease Control and Prevention (CDC), but PHAs use some anonymized data from eICRs to send to the CDC for the development of nationwide statistics.
Policy Path Options
There are several approaches for HCOs to engage with APHL. HCOs should coordinate with their EHR to determine their organization’s policy path from the options below:
Option 1. The eHealth Exchange
Participate in, or connect to, an organization that is a member of the eHealth Exchange.
The eHealth Exchange partners with APHL to provide eCR services to all of its members. With the eHealth Exchange Data Use and Reciprocal Support Agreement and eHealth Exchange participation agreements, the eHealth Exchange can operate under business associate authorities with participating organizations and those that are connected to them. APHL is a business associate of the eHealth Exchange.
As a result of these pre-established agreements, an HCO that is a member in good standing or is otherwise represented through the eHealth Exchange will not need any new agreements to perform eCR. HCOs can determine if their organization, their Health Information Exchanges (HIE), or their EHR company is an eHealth Exchange participant by viewing the eHealth Exchange Participants page of the eHealth Exchange site (external link).
If an HCO participates through another party, such as an HIE, they may need to confirm that the HIE’s agreement with them will cover the exchange if it does not physically go through them. HIE opt-out policies should not preclude the accomplishment of legally required case reporting.
HCOs that are not currently eHealth Exchange members and are not represented in the eHealth Exchange by an HIE or another organization can still become an eHealth Exchange participant to use it for eCR. Contact the eCR Team via the eCR service desk, or contact the eHealth Exchange (external link) to get more information.
Option 2. Carequality
Participate in, or connect to, an organization that is a Carequality Implementer.
All Carequality Implementers, as well as the organizations that connect through these entities, can implement eCR if they have agreed to the Carequality Connection Terms. For example, HCOs using an EHR company that is a Carequality Implementer can participate in eCR if the HCO has agreed to the Carequality connection terms with that EHR company.
Option 3. CommonWell
Participate in, or connect to, an organization that is a member of CommonWell.
CommonWell is a Carequality Implementer, so HCOs whose EHR company is a member of Carequality can also participate under CommonWell’s membership terms and the Carequality Connection Terms without the need for new agreements to perform eCR.
Option 4. The APHL eCR Participation Agreement
For organizations unable to use eHealth Exchange, Carequality, or CommonWell, APHL has an on-line participation agreement for eCR that EHR companies or HCOs can sign. There is no cost associated with this agreement. APHL encourages the use of one of the health information network approaches described in Options #1-3 above, as customization and modifications to the APHL participation agreement cannot be supported.
The online participation agreement should be signed by a person authorized to enter into this agreement on behalf of their HCO. If this on-line agreement is completed, a copy will be returned to the included email address for their records.
