Healthcare - Confirm Policy Path

eCR Data Sharing Policy Overview

Every state and territory in the United States has laws that require and enable the reporting of certain conditions to the appropriate state and/or local public health agency (PHA). Laws differ on whether reporting needs to be done from healthcare organizations to the state and local PHAs, or one or the other. If a patient resides out of the state where care was provided, often the state of the patient’s residence will also require reporting.

The federal Health Information Portability and Accountability Act (HIPAA), in combination with state laws, enables this reporting to public health authorities without patient consent, special authorizations, or data use agreements for the purpose of preventing or controlling disease, injury, or disability (Learn more on the US Department of Health & Human Services Health Information Privacy site (external link)).

The Health Level Seven International (HL7) Electronic Initial Case Report (eICR) standard was developed based on the work of a Council of State and Territorial Epidemiologists (CSTE) task force, which identified the “minimum necessary” data needed for an all-condition, all-jurisdiction initial case report.

Since reportable conditions are stipulated in state and local laws, PHAs are also careful to receive data for only the reportable conditions that are referenced. Since the rules for reporting are complex, it is hard for healthcare organizations and electronic health record (EHR) companies to easily comply without support. In electronic case reporting (eCR), the Association of Public Health Laboratories (APHL) Informatics Messaging Services (AIMS) platform and the CSTE Reportable Conditions Knowledge Management System (RCKMS) are designed to help healthcare organizations connect to a single place and manage these reporting complexities for them.

To help healthcare report, APHL needs to receive eICRs under HIPAA business associate or comparable authorities in order to confirm that conditions are indeed reportable in a given state or territory, before sending them on to the appropriate jurisdictions. In this way, the APHL is supporting HIPAA treatment, payment, and operations needs for public health reporting, and making a public health disclosure to the appropriate PHAs.

eICRS are securely received and processed on behalf of the healthcare organizations from which they originate. Using rules authored by each state and local public health agency, the eICRs are transmitted to appropriate public health agencies. The eICRs are only maintained by APHL AIMS long enough to complete routing to the public health agencies and address any errors in that delivery. Beyond that, eICRs are not retained by APHL AIMS. eICRs are not sent to the Centers for Disease Control and Prevention (CDC), but states use some of the eICR data to send anonymized notifications of case reports they confirm to the CDC to develop nationwide statistics.

There are several approaches for healthcare organizations to engage with APHL:

Option 1. Participate in, or connect to, an organization that is a member of, the eHealth Exchange

The eHealth Exchange is partnering with APHL to provide eCR services to all of its members. With the newest version of the eHealth Exchange Data Use and Reciprocal Support agreement and eHealth Exchange participation agreement, the eHealth Exchange can operate under business associate authorities with participating organizations and those that are connected to them. APHL is a business associate of the eHealth Exchange.

The result of these pre-established agreements is that, if a healthcare organization is a member in good standing or is otherwise represented through the eHealth Exchange, there is no need for any new agreements to perform eCR. You can determine if your organization, your HIE, or your EHR company is an eHealth Exchange participant by viewing the eHealth Exchange Participants page of the eHealth Exchange site (external link).

If your organization participates through another party such as an HIE, you may need to confirm that the HIE’s agreement with you will cover exchange, if it does not physically go through them. HIE opt-out policies should not preclude the accomplishment of legally required case reporting.

If your organization is not currently an eHealth Exchange member and is not represented in the eHealth Exchange by an HIE or other organization, you can still become an eHealth Exchange participant to use it for eCR. Contact the eCR general inquiries team at, or contact the eHealth Exchange (external link) to get more information.

Option 2. Participate in, or connect to, an organization that is a Carequality Implementer

 All Carequality Implementers, as well as the organizations that connect through these entities, can implement eCR if they have agreed to the Carequality Connection Terms. For example, a healthcare organization that uses an electronic health record (EHR) company that is a Carequality Implementer can participate in eCR if the healthcare organization has agreed to the Carequality connection terms with that EHR company.

Option 3. Participate in, or connect to, an organization that is a member of CommonWell

CommonWell is a Carequality Implementer, so healthcare organizations whose EHR company is a member of CommonWell can also participate under CommonWell’s membership terms and the Carequality Connection Terms without the need for new agreements to perform eCR.

Option 4. The Electronic Case Reporting Participation Agreement

For organizations unable to use eHealth Exchange, Carequality, or CommonWell, APHL has an on-line participation agreement for eCR that EHR companies (preferred) or health care organizations can sign. There is no cost associated with this agreement. APHL encourages use of one of the health information network approaches described in Options #1-3 above, as customization and modifications to the participation agreement cannot be supported. 

The online participation agreement should be signed by a person authorized to enter into this agreement on behalf of their healthcare organization. If you complete this on-line agreement, a copy will be returned to the included email address for your records.