Healthcare Providers - eCR Data Sharing Policy Overview

Every state and territory in the United States has laws that require/enable the reporting of certain reportable conditions to the appropriate state and/or local public health agency (PHA). State laws differ on whether reporting needs to be done to the state and local PHAs, or one or the other, for healthcare providers. If a patient resides out of the state of care, it is quite possible that the state of the patient’s residence will also require reporting.

The federal Health Information Portability and Accountability Act (HIPAA), in combination with the state laws, enables this reporting without patient consent, special authorizations, or any data use agreements for the purpose of preventing or controlling disease, injury, or disability (Learn more on the US Department of Health & Human Services Health Information Privacy site (external link)). The Health Level Seven International (HL7) Electronic Initial Case Report (eICR) standard was developed based on the work of a Council of State and Territorial Epidemiologists (CSTE) task force, which identified the “minimum necessary” data needed for an all-condition, all-jurisdiction case report. 

Since reportable conditions are stipulated in state laws, states are careful to receive data for only the reportable conditions that are referenced. Since the rules for reporting are very complex, it is hard for clinical care organizations and electronic health record (EHR) vendors to precisely comply. In electronic case reporting (eCR), the Association of Public Health Laboratories (APHL) Informatics Messaging Services (AIMS) platform and the CSTE Reportable Conditions Knowledge Management System (RCKMS) are designed to help healthcare providers report to one place and navigate these reporting complexities for them.

To help healthcare providers report, APHL needs to receive eICRs under HIPAA business associate authorities in order to confirm that a condition is indeed reportable in a given state or territory, before sending them on to the appropriate jurisdictions. In this way, the AIMS platform is supporting the HIPAA operational need of public health reporting and making a public health disclosure to the appropriate PHAs.

eICRS are securely received and processed on behalf of the provider organizations from which they originate. Using rules authored by each state and local public health agency’s head epidemiologist or their representative, the eICRs are then transmitted to appropriate public health agencies. eICRs are only maintained by APHL AIMS long enough to complete routing to the public health agencies and address any errors in that delivery. eICRs are not then retained by APHL AIMS. eICRs are not sent to the Centers for Disease Control and Prevention (CDC), but states may use some of the eICR data to send anonymized notifications of confirmed case reports to the CDC to develop nationwide statistics.

There are two approaches for healthcare sites to engage APHL with an appropriate HIPAA business associate agreement:

Option 1. Participate in the eHealth Exchange

The eHealth Exchange is partnering with APHL to provide eCR services to all of its members. With the newest version of the eHealth Exchange Data Use and Reciprocal Support agreement and eHealth Exchange participation agreement, the eHealth Exchange can operate under business associate authorities with participating healthcare provider sites and healthcare provider sites that participate through their HIE. APHL is a business associate of the eHealth Exchange.

The result of these pre-established agreements is that, if a healthcare provider site is a member in good standing or is represented in the eHealth Exchange, there is no need for any new agreements to do eCR. You can determine if your organization or your HIE is an eHealth Exchange participant by viewing the eHealth Exchange Participants page of the eHealth Exchange site (external link).  

If your organization participates through a HIE, you may need to confirm that the HIE’s technical setup can accommodate eCR. The HIE needs to be able to exchange the eICR and Reportability Response (RR) Clinical Document Architecture (CDA) documents. In addition, HIE opt-out policies should not preclude the accomplishment of legally required case reporting.

If your organization is not currently an eHealth Exchange member and is not represented in the eHealth Exchange by an HIE, you can still become an eHealth Exchange participant to use it for eCR. The eHealth exchange is offering no-cost, eCR-only memberships. Contact the eCR general inquiries team at eCR-Info@aimsplatform.org, or contact the eHealth Exchange (external link) to get more information.

Option 2. Use Electronic Case Reporting Participation Agreement

For organizations unable to use the eHealth Exchange, APHL offers a separate agreement for the purpose of eCR. This Electronic Case Reporting Participation Agreement (file download) was developed with multi-stakeholder input through the Digital Bridge process. It is in use in multiple healthcare provider sites and your healthcare organization can sign it, as well. There is no cost associated with the use of this agreement. 

While the eCR Participation Agreement may be used indefinitely, organizations may also want to consider using this agreement on a short-term basis before joining  the eHealth Exchange (see Option 1, above) at a later date. 

Once signed, the agreement can be submitted through the eCR general inquiries team at eCR-Info@aimsplatform.org. A fully executed copy will be returned for your records.