The Governmental and Legislative Context of Informatics

Overview

An understanding of the governmental and legislative context of public health informatics is crucial for any public health employee dealing with health information of individuals, whether as patients, health plan enrollees, or the subjects of collected data. Whether a public health agency is defined by function or by delegated governmental authority, the agency itself and its contractors are subject to state and federal laws defining the privacy rights of patients. The single most important federal law governing the use of information by public health agencies and their contractors is the Health Insurance Portability and Accountability Act of 1996 (HIPAA),¹ which applies to or must be taken into account by all healthcare organizations in the United States. The regulations issued by the US Department of Health and Human Services under HIPAA impose comprehensive restrictions on the use and disclosure of individual health information, whether that information appears on a computer device, exists in paper form, or is contained in an oral communication. Federal public health agencies must also comply with and take into account the requirements of the Privacy Act of 1974, which does not apply directly to private organizations but may be applied to agency contractors, vendors, or researchers by agency policies or contractual provisions. Most states have laws controlling the collection and use of information by public health agencies that are equivalent to the federal Privacy Act, which by the same principles apply directly to state agencies and indirectly by policy or contract to private organizations. Many states have also enacted or are considering health information privacy laws applicable to both public and private organizations. While federal Privacy Act requirements are likely to be harmonized with and integrated into HIPAA’s privacy requirements, state law privacy protections that are more stringent than HIPAA will continue to apply. Finally, a public health agency operating a Web site must be aware of privacy issues related to user data it collects and of risk management principles connected to the operation of interactive health communications systems. Emerging consumer protection principles make it necessary to disclose information collection activities, while in some cases federal Food and Drug Administration (FDA) regulations may limit the ways information may be provided to the public.