eCR Data Sharing Policy Overview
Every state and territory in the United States have laws that require / enable the reporting of certain reportable conditions to the appropriate state and/or local Public Health Agency (PHA). State laws differ on whether reporting needs to be done to the state and local PHAs, or one or the other, for healthcare providers of care. If a patient resides out of the state of care, it is quite possible that the state of the patient’s residence will also require reporting.
The federal Health Information Portability and Accountability Act (HIPAA), in combination with the state laws, enables all of this reporting without patient consent, special authorizations, or any data use agreements for the purpose of preventing or controlling disease, injury, or disability (HHS HIPAA guidance). The HL7 Electronic Initial Case Report (eICR) standard was developed based on the work of a Council of State and Territorial Epidemiologists (CSTE) task force identified the “minimum necessary” data needed for an all-condition, all-jurisdiction case report.
Since, reportable conditions are stipulated in state laws, states are careful to only receive data for the reportable conditions that are referenced. And since the rules for reporting are very complex, it is hard for clinical care organizations / EHR vendors to precisely comply. In Electronic Case Reporting (eCR), the Association of Public Health Laboratories (APHL) Informatics Messaging Services platform (AIMS) and the CSTE / CDC Reportable Condition Knowledge Management System (RCKMS) are designed to help healthcare providers report to one place and to help navigate these reporting complexities for them.
To help healthcare providers report, APHL needs to receive eICRs under HIPAA Business Associate authorities, in order to confirm that a condition is indeed reportable in a given state or territory, before sending them on to all of the appropriate jurisdictions. In this way, the AIMS platform are supporting the HIPAA operational need of public health reporting and then making a public health disclosure to the appropriate PHAs.
There are two approaches for healthcare sites to engage APHL with an appropriate HIPAA Business Associate agreement:
Option 1. Participate in the eHealth Exchange
The eHealth Exchange is partnering with APHL to provide eCR services to all of its members. With the newest version of the eHealth Exchange Data Use and Reciprocal Support agreement and eHealth Exchange participation agreement, the eHealth Exchange can operate under Business Associate authorities with participating healthcare provider sites and healthcare provider sites who participate through their Health Information Exchange (HIE). APHL is a Business Associate of the eHealth Exchange.
The result of these pre-established agreements is that if a healthcare provider site is a member in good standing or is represented in the eHealth Exchange, there is no need for any new agreements to do eCR. You can determine if your organization or your HIE is an eHealth Exchange participant from this list.
If your organization participates through a HIE, you may need to confirm that the HIE’s technical setup can accommodate eCR. The HIE needs to be able to exchange the Electronic Initial Case Report (eICR) and Reportability Response (RR) CDA documents. And HIE opt-out policies should not preclude the accomplishment of legally required case reporting.
If your organization is not currently an eHealth Exchange member and is not represented in the eHealth Exchange by a HIE, you can still become an eHealth Exchange participant to use it for eCR. The eHealth exchange is offering no-cost “eCR-only” memberships. Please contact the eCR General Inquiries Desk or contact the eHealth Exchange to get more information.
Option 2. Use Electronic Case Reporting Participation Agreement
For organizations unable to use the eHealth Exchange, APHL offers a separate agreement for the purpose of electronic case reporting. This eCR Participation Agreement was developed with multi-stakeholder input through the Digital Bridge process. It is in use in multiple healthcare provider sites and your healthcare organization can sign it as well. There is no cost associated with the use of this agreement.
While the eCR Participation Agreement may be used indefinitely, organizations may also want to consider using this agreement on a short-term basis before joining eHealth Exchange (see Option 1, above) at a later date.
Once signed, the agreement can be submitted through the eCR General Inquiries Desk. A fully executed copy will be returned for your records.
