No. Reporting information about cases of Neurodegenerative disease in accordance with the requirements of the CDPH authorizing statute and regulations is permitted by HIPAA. The Privacy Rule contains a specific provision authorizing covered entities to disclose protected health information as required by law. See 45 CFR sec. 164.512(a)(1). (Note: Covered entities include health plans, health care clearinghouses and health care providers who conduct certain financial and administrative transactions electronically. These electronic transactions are those for which standards have been adopted by the Secretary under HIPAA, such as electronic billing and fund transfers. More information on covered entities can be found at the HHS website: <a href="http://www.hhs.gov/ocr/privacy/hipaa/faq/covered_entities/)">http://www.hhs.gov/ocr/privacy/hipaa/faq/covered_entities/)</a>

No. The provision of the Privacy Rule authorizing disclosure of protected health information as required by law is an exception to the requirement for written authorization. See 45 CFR sec. 164.512(a)(1).

No. The Privacy Rule does include a general requirement that covered entities make reasonable efforts to limit the disclosure of protected health information to the minimum necessary to accomplish the intended purpose of the disclosure. See 45 CFR sec. 164.502(b)(1). However, there is a specific exception to this requirement for disclosers that are required by law, such as the reporting of information about cases of Neurodegenerative disease to the CNDR pursuant to California law and regulations. See 45 CFR sec. 164.502(b)(2)(v).

No. The Privacy Rule applies to disclosure of protected health information by covered entities as required by law. It does not apply to subsequent use or disclosure by the recipient. However, CNDR authorizing legislation includes strict limits on use and disclosure of reported information. Those requirements include obtaining a federally designated Institutional Review Board approval, and contractual agreements to maintain confidentiality and privacy of the data and to not disclose confidential information beyond the confines of the specific research project. See California Health & Safety Code sec. 103870.1. When a researcher contacts a patient, they are required to inform the patient of how they obtained the patient’s name, that the patient is under no obligation to participate in the study, that their participation or non-participation will not be reported to anyone, and that they may request that no one contact them again.
Occasionally a patient will object to having their name released without prior consent, and CNDR has methods to restrict those names from future contacts. But many patients are happy to participate in special studies in order that we may learn more about diseases to better prevent and treat them. CNDR was created to serve as a resource for research about Neurodegenerative disease. The CDPH has a long history of collecting confidential data and using it for research that saves lives.

Yes. The Privacy Rule requires covered entities to provide an accounting of disclosures of protected health information. See 45 CFR sec. 164.528.

No. The provision of the Privacy Rule authorizing disclosure of protected health information as required by law is an exception to the requirement for written authorization. See 45 CFR sec. 164.512(a)(1).